The California Attorney General is tasked with providing legal opinions on legislation, and the first on privacy came out on March 10, 2022 addressing a question about consumer right to know and information sources.

Question: Under the California Consumer Privacy Act, does a consumer’s right to know the specific pieces of personal information that a business has collected about that consumer apply to internally generated inferences the business holds about the consumer from either internal or external information sources?

Answer: Yes, under the California Consumer Privacy Act, a consumer has the right to know internally generated references about that consumer, unless a business can demonstrate that a statutory exception to the Act applies.

Defining Inferences

“Inference” is defined in CCPA as “the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.”

According to IAPP, “The attorney general considers inferences as personal information under the CCPA when they derive from categories of information found in civil code and when they can be used to build consumer profiles” (California attorney general offers CCPA opinion on data inferences, 2022).

What does this mean for organizations?

Truyo president Dan Clarke says, “Companies may use a combination of purchase history, online interests, social media posts, address, geolocation, or even public information to deduce some potential characteristic about a consumer such as the party they may vote, marital status, income or other elements to comprise a profile or create targeting. It is in no way against the rules to compile or utilize these consumer profiles, in fact many companies do, but you now need to assure that this information is properly disclosed, potentially in notices and almost certainly in subject access requests.”

Michael Hellbusch, Partner at Rutan & Tucker says, “This first ever posted opinion by the Attorney General’s office on CCPA is interesting in that it deals with the subject of consumer rights, but even more intriguing because it is likely indicative of increased interest in privacy rights in general. Perhaps we will see additional action as CCPA evolves into CPRA and more attention is focused on the important topic of consumer data privacy”

References

International Association of Privacy Professionals. (2022, March 14). California attorney general offers CCPA opinion on data inferences. Retrieved March 15, 2022, from https://iapp.org/news/a/california-attorney-general-offers-ccpa-opinion-on-data-inference