- 1798.100 – Consumers right to receive information on privacy practices and access information
- 1798.105 – Consumers right to deletion
- 1798.110 – Information required to be provided as part of an access request
- 1798.115 – Consumers right to receive information about onward disclosures
- 1798.120 – Consumer right to prohibit the sale of their information
- 1798.125 – Price discrimination based upon the exercise of the opt-out right
Does the CCPA apply to information about businesses?
The CCPA only applies to personal information about “consumers,” a term which is defined as “a natural person who is a California resident.”1 As corporations or other legal entities are not people, the CCPA does not apply to information that relates to them. That said, to the extent that information that relates to a business also relates to a real person, and either identifies them or makes the person identifiable, it would be within the scope of the CCPA. As an example, an online rating of a company called Best Dentist would not be governed by the CCPA. An online rating of an office named John Smith DDS (after the dentist that practices there) would (or will) be governed by the CCPA.
It is worth noting, however, that to the extent that information relates to an “employee, owner, director, officer, or contractor” of a company, the obligations of the CCPA phase in over time. Specifically, some provisions went into effect on January 1, 2020, such as possible liability following a data security breach that includes sensitive category information. Other provisions become effective on January 1, 2021, such as the ability of the employee, owner, director, officer, or contractor to request access to their personal information.2