The application side of the coin for many businesses trying to execute CCPA compliance could pose some interesting hurdles. However, the major considerations should include: (i) limiting the scope to verified California residents; (ii) notification of “Do Not Sell My Personal Information” requirements; and (iii) tracking requests and opt-out notifications. This post will specifically begin to dig into (i) limiting the scope to verified California residents.
According to the California Code of Regulations § 17014[1], the consumer is a California resident when he/she has a physical presence in California, and, if away from the State, he/she intends to return to California. As of July 1, 2016, the Assembly Bill 1465 allows California residents can prove State residency, as long as the person’s mailing and residence address is in California, by providing one of a variety of documents or a couple of different options if the documents are not readily accessible.[2] Under the act, personal information can be collected to verify the consumer is in fact a California resident so long as the data collected is only used for the verification purpose. However, what information should be collected that will lead to reliable validation? Let’s look at three possible, while there are likely more, methods to limit the scope of application down to just verified California residents:
While I was in the public sector, we commonly accepted a utility bill, specifically water, in addition to confirming physical and mailing addresses as proof of residency. Small and medium businesses subject the act would likely be able to efficiently process a utility bill with minimal impact; however, a large or enterprise business would likely find physical record collection too burdensome.
Businesses could partner with local governmental organizations to share verification data. While this could prove a more sophisticated method, partnering with governmental organizations can present its own challenges. Aside from the typical challenges of partnering with governmental organizations, California is divided into 58 counties and 482 municipalities. Partnering on the county or municipality level would likely require too many resources to be viable. However, voter registration confirmation is one acceptable way under the Assembly Bill 1465 to validate residency. Access to the voter database could be helpful.
If the business is participating in “big data”, it will likely have access to enough data to verify California residents with more ease. I do not mean that the business must maintain its own set of data; instead, free and paid resources, both in the private and public sectors, exist to compile the requisite verification of California residents. For instance, the California Open Data Portal provides access to data, but you may find dated information through the website: https://data.ca.gov/ . There are countless large data providers that a business can use to verify the consumer as a California resident. Furthermore, coupled with internal consumer data, a large/enterprise sized business should be able to quickly reconcile the two sources for a solid verification. Please reach out to me via email or LinkedIn if you would like to discuss potential options for your business.
[1] https://oag.ca.gov/system/files/initiatives/pdfs/17-0039%20%28Consumer%20Privacy%20V2%29.pdf [2] (1) Rental or lease agreement with the signature of the owner/landlord and the tenant/resident; (2) Deed or title to residential real property; (3) Mortgage bill; (4) Home utility bills (including cellular phone); (5) School documents including any document issued by a U.S. education institution that either includes the applicant’s date of birth, or if a foreign school document, is sealed by the school and includes a photograph of the applicant at the age the record was issued; (6) Medical documents; (7) Employment documents; (8) Faith based documents that include the name and address of the issuing organization; (9) Insurance documents, including medical, dental, vision, life, home, rental, and vehicle; (10) Internal Revenue Service or California Franchise Tax Board tax return; (11) California Certificate of Vehicle or Vessel Title or Registration; (12) Change of Address Confirmation by the U.S. Postal Service (Form CNL 107); (13) Any document issued by an entity, office, or authority governing over a country, state, county, city, municipality, district, agency, department, or any other political subdivision of a country or state that is typed and contains the agency name, department name, state seal, or is on official letterhead; (14) Property tax bill or statement; (15) Record of any state or national banks, state or federal savings associations, trust companies, industrial loan companies, state or federal credit unions, and any institution or entity that has issued a credit card; (16) An acceptable No Fee Identification Card Eligibility Verification (DL 933) form; (17) Voter registration confirmation letter or postcard issued by the California Secretary of State or a local California county elections officer; (18) Proof of payment of resident tuition at a public institution of higher education located in California; (19) An original copy of an approved Claim For Homeowners’ Property Tax Exemption (BOE-266) form filed with a local California County Assessor; or (20) Court documents that list the applicant as a resident of California. See: https://www.dmv.ca.gov/portal/dmv/detail/dl/residency_requirement
Photo – Wikimedia Commons
The Grenier Law Firm believes that education is an important part of top-quality legal services. The excerpts and posts on this site are for educational purposes only. We want to keep educational materials available here for you. However, you must understand that providing these excerpts and posts should not be construed as legal advice or creating an attorney-client relationship between you as the reader and our authors. Because these excerpts and posts are intended as informational, you should always seek out the appropriate legal advice before acting or not acting based on what you read here.
