CCPA

If you do not wish for us to collect information you have the right of "Do Not Sell My Personal Information" by visiting the following link https://www.clarip.com/data-privacy/do-not-sell-my-personal-information you can opt-out at anytime you wish. Please also read out Privacy Policy page for additional information. This can be found at the following link https://www.emeraldgames.com/pages/privacy-policy.html

Below is a guide of what CCPA is and the rights attached to it.

Rights of the consumer under the CCPA

What exactly does the CCPA require?

The right to be informed

Under the CCPA, consumers have a right to be informed about how their information is processed at or before the point of collection.

Under CCPA you must disclose:

  • the categories of personal information the business collects, sells, or shares;
  • the categories of third parties with whom the business shares personal information;
  • the categories of sources from which that information was collected;
  • the business/ commercial purpose for collecting or selling consumers’ personal information;
  • consumers rights and how to exercise them; and
  • how the consumer can object to the selling of their data, via a “Do not sell my data” link (if data is sold).

The right of access

Under the CCPA, consumers have a right to access their personal information when verifiably requested*.

In particular, consumers have the right to access:

  • the categories of the consumer’s personal information collected in the past 12 months;
  • specific pieces of information collected about them;
  • the categories of sources from which the business collected the information;
  • the purposes for collecting or selling the information;
  • the categories of third parties that the personal information is shared with;
  • the categories of personal information sold and the categories of third parties that the personal information was sold to;
  • the categories of personal information disclosed for business purposes.

*Verifiably requested or a “verifiable consumer request” means a request that is made by a consumer, by a consumer on behalf of the consumer’s minor child, or by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, and that the business can reasonably verify . . . to be the consumer about whom the business has collected personal information. Cal. Civ. Code § 1798.140(y)

You must provide consumers with two or more methods for submitting access requests, including at a minimum, a toll-free telephone number, and if the business maintains an internet web site, a web site address. You must also make reasonable efforts to verify that the person making the request is either the consumer about whom the information was collected, or authorized to request this information on behalf of the consumer as outlined above.

The right to portability

Under the CCPA, the right to data portability is bundled together with the right to access, under Section 1798.100 (d).
Where businesses fulfill Access requests “electronically”, it’s also required that the information be provided to the consumer in “portable and, to the extent technically feasible, in a readily usable format that allows the consumer to transmit this information to another entity without hindrance”.

Information requests must be fulfilled, free of charge, within 45 days of the consumer’s verifiable request. This time period may be further extended once by an additional 45 days, if reasonably necessary, and provided that the consumer is given notice of the extension within the first 45-day period.
The disclosures made in the fulfillment of the request should cover the 12-month period preceding the receipt of the request.

Delivery format: Businesses must respond through either regular mail or in an electronic format (such as email, file download, etc.). If delivered electronically, the law mandates that the information must be “portable”, i.e. delivered in a format that’s easy to use and that allows transmission of the information to another entity without hindrance.

Exceptions and limits:

  • Consumers are allowed a maximum of 2 requests over a period of 12 months.
  • Single one-time instances of processing are excluded if the information is not sold or retained by the business or used to otherwise re-identify the person.
  • No response is necessary if the business has not actually collected information on the consumer in question.

The right to to be deleted

The CCPA grants consumers the right to request the deletion of any personal information that has been collected about them. If a verifiable request for deletion is received from a consumer, you must delete the consumer’s personal information from your records and instruct any related service providers to delete the consumer’s personal information from their records.

You must provide consumers with two or more methods for submitting access requests, including, at a minimum, a toll-free telephone number, and if the business maintains an internet web site, a web site address. You must also make reasonable efforts to verify that the person making the request is either the consumer about whom the information was collected, or authorized to request this information on behalf of the consumer as outlined above.

This request must be fulfilled free of charge, within 45 days of the consumer’s verifiable request. This time period may be further extended once by an additional 45 days, if reasonably necessary, and provided that the consumer is given notice of the extension within the first 45-day period.

Exceptions and limits:
Businesses are not required to comply with the request of deletion if the information is needed:

  • to complete the transaction that the personal information was collected for;
  • for the provision of a good or a service requested by the consumer, or to otherwise carry out an agreement between the business and the consumer;
  • to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity;
  • to debug to identify and repair errors;
  • to exercise of free speech, or exercise another consumer’s right to free speech;
  • to comply with the California Electronic Communications Privacy Act (CalECPA);
  • for public or peer-reviewed scientific, historical, or statistical research in the public interest;
  • in order to comply with a legal obligation;
  • to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business;
  • for solely internal use in a lawful manner compatible with the context in which the consumer provided the information.

The right to opt-out (the right to say no to the sale of their data)

Under the CCPA, a consumer has the right, at any time, to tell a business which sells their personal information to third parties, that they must stop selling such personal information.

What is a sale under the CCPA and how do you “sell” personal information?

As mentioned above, under the CCPA, “sell”, “selling”, “sale”, or “sold” means selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic means, a consumer’s personal information by the business to another business or a third party, for monetary or other valuable consideration.

Two less obvious examples of what could* be considered “selling” under the CCPA are:

  • sharing user data with ad networks, and other third-parties in order to display targeted advertising for a benefit including revenue; or even
  • using 3rd-party analytics program for retargeting or otherwise generating a user-profile for selling to the consumer.

*Keep in mind that at this stage of implementation some factors may change as the law is further refined.

If you “sell” consumers’ personal information to third parties, you must disclose this fact to consumers, and must also inform them that have the right to opt-out of the sale of their personal information (as per “The right to be informed” listed above).

A consumer cannot be asked to create an account in order to opt-out. Instead, this process should be facilitated via a “Do Not Sell My Personal Information” (“DNSMPI“) link on your website or privacy notice.

If a business receives direction from a consumer not to sell the consumer’s personal information, it is prohibited from selling the personal information of that consumer unless the consumer subsequently provides express authorization for the sale of their personal information (Opt-in).

Businesses may only ask for a consumer’s authorization one more time, and only 12 months after the consumer have opted-out.

The right to opt-in (prior consent for minors)

Businesses are prohibited from selling the personal information of consumers if the business has actual knowledge that the consumer is under the age of 16. In such cases, businesses may only sell the information if:

  • the consumer is between 13 and 16 and has opted-in; or
  • the consumer is less than 13 years of age and the consumer’s parent or guardian has opted-in on the consumer’s behalf.

The right to not be discriminated against (even if the consumer exercises their privacy rights)

Under the CCPA, businesses are prohibited from discriminating against consumers for exercising their rights granted under the law. Prohibited forms of discrimination include:

  • Denying goods or services to the consumer.
  • Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
  • Providing a different level or quality of goods or services to the consumer, if the consumer exercises the consumer’s rights under this title.
  • Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

Exceptions and limits:

  • A business may only charge or offer different prices, rates, levels, quality of goods or services in cases where that difference is reasonably related to the value provided to the consumer by the consumer’s data.

    For example, a business offers a standard 30% discount on a product as an incentive to re-purchase, one month after the consumer’s initial purchase of the same product. During that time, the consumer exercises their right to deletion and requests that their personal information be deleted. In this case, because the business no longer has the consumer data which shows that the consumer previously purchased the product, they cannot reasonably offer the standard 30% discount to that particular consumer.

  • A business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale of personal information, or the deletion of personal information. In such cases, such financial incentives must be disclosed to users via the homepage of your website and within your privacy policy.

    Businesses are prohibited from using financial incentive practices that are “unjust, unreasonable, coercive, or usurious in nature.

Source: https://www.iubenda.com/en/help/19133-ccpa-guide#rights-of-the-consumer

Page Created on 25/11/2019 and Page Updated on 25/11/2019 to comply with CCPA.

Ir hacia arriba