CCPA Privacy and Security FAQs: Does the CCPA define “personal information” differently for privacy and security purposes?

Yes.

The sections of the CCPA that relate to data privacy (i.e., the collection, use, and sharing of information) use a definition of “personal information” that includes approximately 26 categories or types of data.1That said, an amendment to the CCPA deferred the full impact of the Act upon employee data until January 1, 2021.2 In contrast, the sections of the CCPA that relate to data security (i.e., the protection of information) adopt a far narrower definition of “personal information” that includes only 6 categories of types of data.  The following chart indicates which categories of personal information apply to the data privacy and the data security sections of the CCPA:

Examples of Personal Information Applies to Privacy Requirements of CCPA Applies to Security Requirements of CCPA
1.          Audio, electronic, visual, thermal, olfactory, or similar information 3  
2.          Bank account number 4 5
3.          Biometric information 6  
4.          Commercial information (e.g., products or services purchased, or other purchasing or consuming histories or tendencies) 7
5.          Credit card number 8 9
6.          Debit card number 10 11
7.          Driver’s License Number / State ID 12 13
8.          Education 14  
9.          Electronic network activity (e.g., browsing history) 15  
10.       Email address 16 Partial ✓17
11.       Employment 18  
12.       Employment history 19  
13.       Geolocation data 20  
14.       Health insurance information 21 22
15.       Identifiers (e.g., name or alias) 23 Partial ✓24
16.       Insurance Policy Number 25 26
17.       Medical information 27 28
18.       Online identifier (e.g. IP address) 29  
19.       Other financial information 30  
20.       Passport Number 31  
21.       Physical Characteristics 32  
22.       Postal address 33  
23.       Signature 34  
24.       Social Security Number 35 36
25.       Telephone Number 37  
26.       Transaction information 38