Comcast Xfinity CCPA Policy I have an old login with Comcast under a relative’s primary (billed) account that I'd like to have deleted under CCPA. The relative lives in Florida, but I am a California resident. I'm attempting to request the deletion of my login and personal information through CCPA. After many emails and calls to Comcast's privacy department, I finally got them to proceed with my account deletion about a month ago. But a few days ago I got a voicemail that it hadn't gone through because the &quot;primary account holder needed to approve it&quot;. Since I've already been authenticated and this CCPA request is solely for my own account and personal information, I don’t see why this is necessary. The primary account holder could call to delete their own account, but that would be subject to Comcast’s national policy and not covered by CCPA. Is this a valid reason to deny a CCPA request? I’ve made it clear in writing multiple times that it is only for my own personal information.
Update: I've filed a complaint with the CA Attorney General. They automatically forwarded the complaint to Comcast and sent me a notice in the mail. If you have filed a complaint against a business, we will forward your complaint to that business and request that it contact you promptly to resolve the issues you raised. Please note that we cannot represent you, advocate for you with the business, or force the business to satisfy individual requests for relief. Please contact the business directly to discuss your complaint. While we cannot provide specific legal advice, please see the information below, which may help address your concern. For more information about the CCPA, please see https://oag.ca.gov/privacy/ccpa and https://cppa.ca.gov/. [...] If a business has violated the CCPA, you may notify the Office of the Attorney General by filing a consumer complaint. While we cannot file an action on behalf of an individual consumer over an individual violation, consumer complaints are an important source of information for the office. We will review consumer complaints to identify patterns of misconduct and to determine what law enforcement actions to take. You can sue a business under the CCPA only if your unencrypted and un-redacted personal information was stolen in a data breach as a result of the business's failure to maintain reasonable security procedures and practices to protect it. You must generally give the business written notice of its violations and 30 days to fix the violations before you can sue. For more information about when you can sue for a CCPA violation, visit https://oag.ca.gov/privacy/ccpa If you want to consult an attorney, you can obtain a referral to a certified lawyer referral service through the State Bar at (866) 442-2529 (toll-free in California) or (415) 538-2250 (from outside California), or online at https://www.calbar.ca.gov. If you cannot afford to pay an attorney, contact your local legal aid office to see if you qualify for free or reduced-rate legal assistance. For a referral to local legal aid offices, visit https://lawhelpca.org/ and click on the Search for Legal Help tab. Comcast responded immediately to the forwarded complaint and appears to have deactivated my login, but nearly a month later have still not confirmed whether any personal information has been deleted. I'd strongly recommend anyone in a similar situation to file a complaint as well. There's no guarantee the Attorney General or California Privacy Protection Agency will act on it, but it can increase the civil penalty to the company by $5,000 per complaint (see section 1798.155) and makes it more likely they will comply. Don't waste your time with any unnecessary calls from the business or obfuscating information yourself as a commenter here mentioned. Just submit your CCPA request in writing, complete the identity verification, wait the 45 days as allowed by the law (or 90 if an extension is requested, see section 1798.130), and file a complaint if it's not completed. Update 2: I received a forwarded letter from Comcast to the Attorney General in response to my complaint. They lied and backdated their alleged completion date of the deletion request to fall within the 45 day deadline, despite emails I sent past their claimed date repeating the request as I was still able to login. Before filing a complaint, make sure to take screenshots showing you logged into the account and email it to the business in order to document it.
It's not illegal to ask. Whether they can give it to you, and under what circumstances, is another, much more complicated matter. For instance, if the database contains health information covered by HIPAA in the United States, or personal information covered by laws like GDPR or CCPA, the customer's ability to share the database may be restricted, either requiring additional confidentiality obligations/use restrictions, or preventing sharing entirely.
The provider has a legitimate interest in the data subjects data, and therefore they can override the right of deletion. See this example from the UK's Information Commissioners Office: A finance company is unable to locate a customer who has stopped making payments under a hire purchase agreement. The customer has moved house without notifying the finance company of their new address. The finance company wants to engage a debt collection agency to find the customer and seek repayment of the debt. It wants to disclose the customer’s personal data to the agency for this purpose. The finance company has a legitimate interest in recovering the debt it is owed and in order to achieve this purpose it is necessary for them to use a debt collection agency to track down the customer for payment owed. The finance company considers the balancing test and concludes that it is reasonable for its customers to expect that they will take steps to seek payment of outstanding debts. It is clear that the interests of the customer are likely to differ from those of the finance company in this situation, as it may suit the customer to evade paying their outstanding debt. However, the legitimate interest in passing the personal data to a debt collection agency in these circumstances would not be overridden by the interests of the customer. The balance would be in favour of the finance company. Article 17 of the GDPR, the &quot;Right to be forgotten&quot;, says this: The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies: A) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; B) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or point (a) of Article 9(2), and where there is no other legal ground for the processing; C) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2); In your example, it's obvious that the personal data is still necessary for performance of the contract (Art 6(1)(b)) such as collecting payment, or for fulfilling legal obligations (Art 6(1)(c), Art 17(3)(b)) such as the obligation to keep financial records. Thus, there continues to be a legal basis for processing/keeping the data and rejecting the erasure request in whole or in part. Things are slightly different when the legal basis for this processing was consent (Art 6(1)(a)) or a legitimate interest (Art 6(1)(f)). Consent can always be withdrawn, but this kind of data collection is not typically based on consent. You can sometimes object to processing under a legitimate interest (see Art 21) but that doesn't work when the data controller has overriding legitimate grounds to continue processing. Such overriding grounds might be the legitimate interest to pursue the debt, and Art 21(1) and Art 17(3)(e) explicitly call out the “establishment, exercise or defence of legal claims” as overriding grounds. So that covers requests under A, B and C. Things like legal basis and erasure/objection must be analyzed on a per-purpose basis, so it is possible that you could get a partial erasure, such as erasing information that's only necessary for marketing (compare also objection per Art 21(2)). But its quite clear to me that a data subject cannot get out of paying a bill by using the GDPR.
Let me be sure that I understand the situation. You set up an account with Big Company, which uses BigCo as a trademark. You want email about that account to reach you with a unique address, so you set up 'BigCo@RichDomain.Com" and gave that as your email when setting up tha account. You don't plan to use that address for any purpose but communications from BigCo to you and from you to them. (Of course these aren't the actual names.) Have I understood the situation correctly? It seems that you ar not using 'BigCo" in trade, nor are you likely to be confused with an official representative of BigCo, so you are not infringing their trademark. However, someone using such an email more generally could perhaps be so confuse, so BigCo has a somewhat legitimate concern, as they cannot know the very limited use you plan to make of this address. The only way that the could force you not to use such an email address would be via a court order as part of a suit for trademark infringement, whcih under the circumstances I doubt they would get. However, unless they have some sort of contract with you to the contrary, they can control who registers on their site. and could refuse to register you using an email address that includes their name or alias. Convincing them to accept your registration, even though it does no harm to them, will almost surely be more trouble than it is worth. Give them "BigFirm@RichDomain.Com" or something else that is not their name, but will suggest their name enough that you will know who it is. This will serve your purpose fully, and avoid a long argument with people who are reading from a script (once you get past the automated process, if you can even do that). This is all assuming that I have understood the situation correctly. I am also largely assuming US law, since you didn't mention a jurisdiction. (EDIT: UK law should not be very different on these points.)
This is actually pretty standard. You have a contract with a business to provide some service, and you get a bargain on the price of the service as long as you stay with them for some period, such as 2 years. You could get the 'pay as you go' option which doesn't have a termination fee, but that costs more if you are sure you can commit to what you signed up for, for that period. So it's not that you can't terminate the contract, it's that you can't just walk away from your obligation (what they call a "minimum term agreement"), cost-free. The early-termination fee is part of the cost of moving. You have to look in the Legal Agreements &amp; Contract part of Account Details on your account to get the specific agreement that you are bound by. Generally, you are subject to that fee, unless the subscriber dies, or is in the military and is shipped out. You can also transfer your service from area to area – I assume you either are moving to an area without Xfinity service, or you elected to not use Xfinity in that location. It is legal for a business to put their business interest above that of a customer, even in the case of regulated "utilities".
In order to process data (which includes storing data), a data controller must establish one or more of the lawful bases contained at Article 6(1) of the UK GDPR. Briefly, those are: a) Consent of the data subject b) Necessary for performance of a contract with the data subject c) Necessary for compliance with a legal obligation d) Necessary to protect vital interests of data subject or another person e) Necessary for public interest or exercise of official authority vested in the controller f) Necessary for controller's legitimate interests Clearly a) and d) don't apply. As you've settled the debt, it seems unlikely to me that b) or f) apply. That leaves c) and e). A common example under c) would be a requirement by Companies House or HMRC to keep accounting records for a certain period of time. Some public bodies may also find it necessary, under e), to retain records which they need to be able to carry out their other functions. It seems highly unlikely to me that either of these would justify retention for your &quot;lifetime&quot; however. I would start by sending them a written demand to have your data erased under Article 17(1). Make sure you also specifically request that they provide you with all the information (and in particular the purposes of the processing) under Article 15(1), and that, in the event that they refuse to erase your data, they explain the reasons why pursuant to Article 12(4). Their response on these points will be helpful in establishing whether there is a lawful basis. Your next step after that is either to complain to the ICO or to apply to court for a compliance order under Section 167 of the Data Protection Act 2018. The former is free while the latter is not and carries risks of cost if you are unsuccessful. If you opt for one of these steps, make sure you cite the relevant provisions of the GDPR and explain why you think there is no lawful basis for the data retention (including by referencing any response you received from them). &quot;I have read GDPR guides on how to request erasure, but I don't really feel this applies- I want to have my account deleted, not the track record of the loan and repayment&quot; It doesn't matter whether we are talking about your account or your track record. What matters is whether the account constitutes personal data, which it almost certainly does, per the definition at Article 4(1): &quot;‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;&quot;
A CC0 license granted by party A only waives their rights, and not those of unrelated party B (i.e. Marvel). And while Marvel might have granted the cosplayer a limited right to depict their persona's, that almost certainly does not constitute a sublicensable right. This is especially the case if the rights are implicitly granted (by Marvel not acting).
It is any law protecting me from the people that distrubute a video of me falling the stairs and shared without my permision? No. Your permission is not necessary for distributing or watching that video. The recording was from your workplace, where your entitlement to privacy is quite limited unlike few settings such as (1) your attorney's office in the course of obtaining legal advice for which the disclosure was needed, or (2) your home. Even if such an entitlement existed, your decision to share that recording with the person who was with you generally constitutes a waiver of your right to privacy regarding that incident. The waiver would apply even if California had some legislation akin to the EU's GDPR. Your description nowhere indicates that that person had a statutory or equitable duty of confidentiality. It is also highly doubtful that you would wish to block the distribution of the video if people instead of mocking you expressed something pleasant or encouraging to you. people who I don't even know their names come to me to comment about the video and joke about not falling again. That is not unlawful in and of itself. Since the matter does not involve a protected category such as sex, race, religion, or disability, pursuing a claim of hostile work environment would be quite a stretch. It would also be futile because any relief would not cover outsiders who watch the video and feel like joking about it. The notion of harassment entails a pattern of conduct (meaning that a person engages twice or more in that conduct) that causes a reasonable person to feel annoyed or concerned for his safety. Even if someone engages makes a few jokes that cause you to get annoyed, any petition for restraining orders seems unlikely to succeed. Sooner rather than later, the jokes will get old and people will move on.