Page 90 - GDPR and US States General Privacy Laws Deskbook

11 C.C.R. § 7028. Requests to Opt-In After Opting-Out
of the Sale or Sharing of Personal Information
(a)  Requests to opt-in to sale or sharing of personal information shall use a two-step opt-in process whereby the consumer
shall first, clearly request to opt-in and then second, separately confirm their choice to opt-in.
(b)  If a consumer who has opted-out of the sale or sharing of their personal information initiates a transaction or attempts
to use a product or service that requires the sale or sharing of their personal information, the business may inform the
consumer that the transaction, product, or service requires the sale of their personal information and provide instructions
on how the consumer can provide consent to opt-in to the sale or sharing of their personal information. The business shall
comply with section 7004 when obtaining the consumer’s consent.
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.120, 1798.135 and 1798.185, Civil Code.
Article 4. SERVICE PROVIDERS, CONTRACTORS, AND THIRD PARTIES
11 C.C.R. § 7050. Service Providers and Contractors
(a)  A service provider or contractor shall not retain, use, or disclose personal information collected pursuant to its written
contract with the business obtained in the course of providing services except:
(1)  For the specific business purpose(s) set forth in the written contract between the business and the service provider or
contractor that is required by the CCPA and these regulations.;
(2)  To retain and employ another service provider or contractor as a subcontractor, where the subcontractor meets the
requirements for a service provider or contractor under the CCPA and these regulations.;
(3)  For internal use by the service provider or contractor to build or improve the quality of the services it is providing to
the business, even if this business purpose is not specified in the written contract required by the CCPA and these
regulations, provided that the service provider or contractor does not use the personal information to perform services
on behalf of another person. Illustrative examples follow.
(A)  An email marketing service provider can send emails on a business’s behalf using the business’s customer email list.
The service provider could analyze those customers’ interactions with the marketing emails to improve its services
and offer those improved services to everyone. But the service provider cannot use the original email list to send
marketing emails on behalf of another business.
(B)  A shipping service provider that delivers businesses’ products to their customers may use the addresses received
from their business clients and their experience delivering to those addresses to identify faulty or incomplete
addresses, and thus, improve their delivery services. However, the shipping service provider cannot compile the
addresses received from one business to send advertisements on behalf of another business, or compile addresses
received from businesses to sell to data brokers.
(4)  To prevent, detect, or investigate data security incidents or protect against malicious, deceptive, fraudulent or illegal
activity, even if this business purpose is not specified in the written contract required by the CCPA and these regulations.;
(5) For the purposes enumerated in Civil Code section 1798.145, subdivisions (a)(1) through (a)(74).
(b)  A service provider or contractor cannot contract with a business to provide cross-context behavioral advertising. Pursuant
to Civil Code section 1798.140, subdivision (e)(6), a service provider or contractor may contract with a business to provide
advertising and marketing services, but the service provider or contractor shall not combine the personal information of
California Consumer Privacy Act of 2018 (as amended by the
90 | 
California Privacy Rights Act of 2020) and Related Regulations