COMPLIANCE
CCPA 2020: What’s Happened and What to Expect By DANIEL BARBER
T
his past July, the California Consumer Privacy Act (CCPA) hit two milestones. The six-month point of the law being in force arrived, and enforcement began. The law had a six-month grace period, but no one anticipated that during this period there would be a pandemic that forced millions to switch to remote work with most activities moved online. Nevertheless, California Attorney General Xavier Becerra decided to continue with enforcement as planned. With enforcement ramping up, organizations are being tested on whether they can handle BACK TO CONTENTS
managing data subject requests from users, along with CCPA requirements regarding selling data and disclosures surrounding consumer data. Were businesses ready for the CCPA?
Data Subject Requests One of the most frequently asked questions is, “How many data subject matter requests should I expect per year?” The answers vary by industry and company size. Understanding the types of request a business will receive can help them plan for how to handle and process requests. Under the CCPA, there are
three different types of requests users can make to a company: the right to know the data collected, or access requests; deletion requests; and “do not sell” (DNS) requests. By a large margin, consumers preferred to have their records deleted at the beginning of 2020. But as the year progressed, DNS requests increased and have subsequently remained the most common request. Our research found that 48 percent of all requests were DNS compared to 31 percent for deletion requests and 21 percent for access requests. To answer how many Data Subject Requests (DSRs) businesses should expect per year,
NOVEMBER 202 0 TODAYSGENERALCOUNSEL.COM
7
