If the CCPA applies to you (you can take the short assessment here to see if it applies to you), you can use the checklist below to quickly review or asses your basic CCPA compliance.
Tout d’abord, un petit récapitulatif : qu’est-ce que le CCPA ? Le California Consumer Privacy Act (CCPA) est la nouvelle loi californienne sur la protection de la vie privée. Elle vise à améliorer les droits des consommateurs résidents de la Californie (États-Unis) en matière de vie privée. Le CCPA définit de nouvelles exigences concernant le traitement des informations permettant d’identifier des personnes et accorde aux consommateurs californiens des droits supplémentaires.
Check-list CCPA
Évaluez les processus et les systèmes de votre entreprise
En matière de conformité, il est primordial d’examiner honnêtement vos processus et vos systèmes.
Voici quelques questions pour vous mettre sur la bonne voie. Cochez-les à mesure que vous y répondez.
What categories of personal data do I collect and which categories of third-parties do I share this data with?
Which sources do I collect this information from and what are their categories (e.g. analytics)?
What are the reasons or purposes of my data collection?
Which CCPA consumer rights (if any) do not apply to my processing activities?
Which exceptions reasonably and honestly apply to my scenario?
Am I keeping track of all the service providers* that access consumers’ personal information on my behalf?
Can I reliably contact these parties to fulfil things like deletion requests?
Do I maintain reliable records of the information and the categories of personal information I collect for each consumer?
Do I have the documents (e.g privacy policy or terms and conditions) I need to make legally required disclosures available on my website?
*Service Providers are entities that collect personal information on behalf of the business and not for their own purposes – it’s similar to a Processor under the GDPR. Full definition and exceptions here https://www.oag.ca.gov/sites/all/files/agweb/pdfs/privacy/ccpa-proposed-regs.pdf (pg.14)
Communiquez les informations exigées et honorez les demandes d’exercice des droits des consommateurs
Le droit à l’information
Keep internal records of the type of processing you do (including who your service providers are) so that you’re able to include relevant details in your privacy policy, and potentially at the point of data collection (e.g a contact form) if applicable.
Displaying CCPA related language, disclosures, and instructions in your privacy policy
Update privacy policy every 12 months
Le droit d’accès et le droit à la portabilité
Have in place a way of retrieving information processed on specific consumers. One approach to this is simply being aware of what processes typically apply to particular user groups or transactions. From there you can compare against your internal privacy, sales, database or consent records to retrieve the relevant information.
Have the means of fulfilling access requests either through regular mail or electronically (such as email, file download, etc.) in a format that’s easy to use and that allows the information to be easily transmitted to another person or company without hindrance.
Le droit d’opposition
Display a CCPA notice of collection;
Display a “Do Not Sell My Personal Information” (DNSMPI) link that allows the consumer to opt-out
Actually facilitate the opt-out and stop the selling action for the particular consumer
Le droit de consentement
Ensure that in cases where you are aware that the consumer is a minor under the age of 16 you do not sell their information unless explicitly authorized to do so by a parent or guardian (for minors under 13) or if explicitly authorized to do so by the minor consumer in cases where the minor is between the ages of 13-16.
droit de ne pas faire l’objet d’une discriminationLe droit de ne pas faire l’objet de discrimination
Do Not Discriminate Against Consumers Exercising Their Rights.