Q: If we delete someone’s personal information, how can we keep enough information to know not to add them again?
CLICBrain: For covered brokers processing DROP requests, this requires distinguishing the consumer’s commercial profile from the limited information needed to maintain compliance.
CalPrivacy’s guidance instructs brokers to retain only the minimum information necessary for that compliance purpose and not use it for another purpose. It also addresses ongoing identifiers for both matched and unmatched requests.
The purpose is not necessarily to prohibit every form of collection under every circumstance. It is to recognize the applicable request and carry out its required effect, including recurring deletion and restrictions on sale or sharing.
Operational questions include:
-
What minimum identifiers are necessary?
-
Can they be separated from active commercial and marketing records?
-
Are access and permitted uses restricted?
-
Can incoming information be checked against them before sale or sharing?
-
Are previously unmatched requests included?
-
Can relevant service providers and contractors honor the required instruction?
-
How are amended requests and applicable exceptions handled?
-
Can the organization demonstrate that the retained information is used only for its compliance purpose?
The exact design depends on the applicable requirements and the organization’s systems.
The governing principle is straightforward: Preserve the instruction without rebuilding the profile that should have been deleted.
Have another compliance question? Ask CLICBrain on CLIClaw.com.
CLICBrain Weekly Briefings provide operational compliance intelligence and commentary for internet businesses. Regulatory developments, enforcement activity, and legal requirements discussed herein should be evaluated in the context of your organization’s specific operations, systems, data practices, jurisdictions, and risk profile. This briefing is for informational and educational purposes only and does not constitute legal advice.