California Consumer Rights

California Consumer Rights Workflow

Overview

The CCPA/CPRA grants California consumers six categories of privacy rights enforceable against businesses that meet the applicability thresholds under Cal. Civ. Code §1798.140(d). These rights are modeled after but distinct from GDPR data subject rights, with California-specific verification requirements, response timelines, and scope limitations.

The California Privacy Protection Agency (CPPA) regulations (11 CCR §7001-7102) provide detailed implementation requirements for consumer request handling, including verification standards, response formats, and authorized agent procedures.

Consumer Rights Matrix

Right to Know (§1798.100, §1798.110, §1798.115)

Categories Disclosure

Upon verified request, the business must disclose for the 12-month period preceding the request:

1. Categories of personal information collected
2. Categories of sources from which PI was collected
3. Business or commercial purpose for collecting, selling, or sharing PI
4. Categories of third parties to whom PI was disclosed
5. Categories of PI sold and, for each category, the categories of third parties to whom it was sold
6. Categories of PI disclosed for a business purpose and, for each category, the categories of recipients

Specific Pieces Disclosure

Requires heightened verification (three data points plus a signed declaration under penalty of perjury). The business must provide the specific pieces of PI it has collected about the consumer in a portable, readily usable format (structured, commonly used, machine-readable).

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. provides a Know My Data portal that generates two report formats:

• PDF report: Human-readable summary with categories, sources, purposes, and recipients listed in plain language
• JSON export: Machine-readable structured data including all specific pieces of PI, organized by category with collection timestamps

The system enforces the 12-month lookback period automatically. Consumers may request data beyond 12 months, which Liberty Commerce Inc. provides where reasonably feasible per §1798.130(a)(2).

Right to Delete (§1798.105)

Processing Steps

1. Receive request through designated channels (web portal, email, toll-free number)
2. Verify identity — match at least two data points (name + email, email + account number, etc.)
3. Confirm intent — for requests submitted by means other than the designated portal, confirm the consumer's intent to delete
4. Identify applicable exceptions (§1798.105(d)):
   • Complete the transaction for which the PI was collected
   • Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity
   • Debug to identify and repair functionality errors
   • Exercise free speech or ensure another consumer's right to exercise free speech
   • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code §1546)
   • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest
   • Enable solely internal uses reasonably aligned with consumer expectations based on the consumer's relationship
   • Comply with a legal obligation (e.g., tax record retention per 26 U.S.C. §6001)
   • Otherwise use the PI internally in a lawful manner compatible with the context of collection
5. Execute deletion — delete PI from active systems and direct service providers and contractors to delete
6. Handle deferred deletion — for PI in backup/archival systems, mark for deletion at next scheduled maintenance cycle
7. Notify consumer — confirm deletion or explain partial denial with specific exception cited

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. executes a cascading deletion workflow:

• Active database records: Deleted within 10 business days
• Service provider systems (PaySecure Corp., SwiftShip Logistics): Deletion request forwarded with 30-day compliance deadline
• Backup systems: Marked for deletion at next 90-day rotation
• Retained data: Tax records (7 years per IRS requirements), fraud investigation records (duration of investigation plus 3 years)

Right to Correct (§1798.106)

Added by CPRA, effective January 1, 2023. Consumers may request that a business correct inaccurate personal information, taking into account the nature of the PI and the purposes of processing.

Business Obligations

The business must use commercially reasonable efforts to correct the PI. If the business contests the correction, it must:

• Notify the consumer of the decision
• Provide instructions for the consumer to submit documentation supporting the correction
• Consider the documentation and correct the PI if warranted
• If maintaining its decision, allow the consumer to submit a written addendum to the record

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. allows self-service correction for profile fields (name, address, email, phone number). For non-self-service data (transaction records, loyalty tier, inferred preferences), consumers submit correction requests through the privacy portal with supporting documentation. The privacy team reviews within 15 business days and either corrects or responds with reasoning.

Right to Opt-Out of Sale and Sharing (§1798.120)

Two Distinct Operations (Post-CPRA)

1. Sale (§1798.140(ad)): Disclosure of PI to a third party for monetary or other valuable consideration
2. Sharing (§1798.140(ah)): Disclosure of PI to a third party for cross-context behavioral advertising, regardless of monetary exchange

Both must be subject to the opt-out right. The business must provide a "Do Not Sell or Share My Personal Information" link on its homepage.