Page 78 - GDPR and US States General Privacy Laws Deskbook

(2)  To the extent that an exception applies to the deletion of personal information, deleting or enabling the business to
delete the consumer’s personal information that is not subject to the exception and refraining from using the consumer’s
personal information retained for any purpose other than the purpose provided for by that exception;
(3)  Notifying any of its own service providers or contractors to delete from their records in the same manner the consumer’s
personal information that they Collected pursuant to their written contract with the service provider or contractor; and
(4)  Notifying any other service providers, contractors, or third parties that may have accessed personal information from
or through the service provider or contractor, unless the information was accessed at the direction of the business, to
delete the consumer’s personal information unless this proves impossible or involves disproportionate effort.
(d)  If a business, service provider, or contractor stores any personal information on archived or backup systems, it may delay
compliance with the consumer’s request to delete, with respect to data stored on the archived or backup system, until
the archived or backup system relating to that data is restored to an active system or is next accessed or used for a sale,
disclosure, or commercial purpose.
(e)  In responding to a request to delete, a business shall inform the consumer whether or not it has complied with the
consumer’s request. The business shall also inform the consumer that it will maintain a record of the request as required by
section 7101, subsection (a). A business, service provider, contractor, or third party may retain a record of the request for
the purpose of ensuring that the consumer’s personal information remains deleted from its records.
(f) In cases where a business denies a consumer’s request to delete in whole or in part, the business shall do all of the following:
(1)  Provide to the consumer a detailed explanation of the basis for the denial, including any conflict with federal or
state law, or exception to the CCPA, or factual basis for contending that compliance would be impossible or involve
disproportionate effort, unless prohibited from doing so by law;
(2) Delete the consumer’s personal information that is not subject to the exception; and
(3) Not use the consumer’s personal information retained for any other purpose than provided for by that exception; and
(4)  Instruct its service providers and contractors to delete the consumer’s personal information that is not subject to
the exception and to not use the consumer’s personal information retained for any purpose other than the purpose
provided for by that exception.
(g)  If a business that denies a consumer’s request to delete sells or shares personal information and the consumer has not
already made a request to opt-out of sale/sharing, the business shall ask the consumer if they would like to opt-out of the
sale or sharing of their personal information and shall include either the contents of, or a link to, the Notice of Right to
Opt-out of sSale/sSharing in accordance with section 7013.
(h)  In responding to a request to delete, a business may present the consumer with the choice to delete select portions of their
personal information as long as a single option to delete all personal information is also offered. A business that provides
consumers the ability to delete select categories of personal information (e.g., purchase history, browsing history, voice
recordings) in other contexts, however, must inform consumers of their ability to do so and direct them to how they can
do so. For example, a business may provide the consumer with a link to a support page or other resource that explains
consumers’ data deletion options.
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.100, 1798.105, 1798.110, 1798.115, 1798.130
and 1798.185, Civil Code.
California Consumer Privacy Act of 2018 (as amended by the
78 | 
California Privacy Rights Act of 2020) and Related Regulations