LGPD vs CCPA

The CCPA allows consumers to request that businesses delete their Personal Information upon receipt of a verified consumer request. The request must be complied with by the business free of charge unless:

• the business refuses the request in which case it must inform the consumer with reasons for refusal and an option to appeal the decision.
• the business finds the requests to be excessive or manifestly unfounded due to their repetitive character in which case it may charge a reasonable fee or refuse to act on the request of the consumer.

Businesses are duty bound to verify that the request has been made by the consumer.

There are many exceptions which businesses may use to decline to  comply with the request which include:

• (i) to complete the transaction for which the Personal Information was collected;
• (ii) provide a good or service requested by the Consumer or reasonably anticipated within the context of a Business’ ongoing relationship with the Consumer;
• (iii) or otherwise perform a contract between the Business and a Consumer;
• (iv) detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity, or prosecute those responsible for that activity;
• (v) debug and to identify and repair errors that impair functionality;
• (vi) exercise or ensure free speech or other legal rights;
• (vii) comply with the California Electronic Communications Privacy Act;
• (viii) engage in certain research in the public interest that adheres to all other applicable ethics and privacy laws, when deletion is likely to render impossible or seriously impair such research,
• (ix) if the Consumer has provided informed consent;
• (x) undertake internal uses that are reasonably aligned with the expectations of the Consumer’s relationship with the Business;
• (xi) comply with a legal obligation; and
• (xii) otherwise undertake internal uses in a lawful manner that are compatible with the context in which the Consumer provided the information.

The CCPA also stipulates that information on the following must be provided to consumers:

• At the point of collection, the categories of and specific pieces of personal information of the consumers collected for business purposes in the previous 12 months;
• Categories and specific pieces of personal information collected of consumers by the business along with the commercial purpose for collection, the categories of sources it is collected from and categories of third parties it is shared with;
• If the business sells/discloses personal information of the consumers, then it must inform the categories of personal information disclosed/sold along with the categories of third parties it was sold/disclosed to in the preceding 12 months. If the business does not sell/disclose any personal information of the consumer, it must state so as well.
• the rights of consumers to request for access or erasure of their personal information and the right to not be discriminated along with the mechanisms available to them to exercise those rights;
• The CCPA also provides that if any additional personal information of the consumer is collected the consumer must be informed about it before collection.

CCPA provides consumers with a right to opt out from the selling or disclosing for business purposes of their personal information. The opt-out can therefore only stop the selling of personal information, and it does not impact other uses of their information. However, the right to opt out of the sale is absolute i.e. that businesses cannot reject an opt-out request on the basis of their compelling legitimate grounds and it can be exercised whenever by the consumer.

Businesses must adhere to the language provided in CCPA, namely the homepage of their website must have a link titled ‘Do Not Sell My Personal Information’ and it must also be prominently featured in the Privacy Policy.

Consumers are  also to be provided a notice and must be allowed to opt out of the sale of their personal information by a third party.

The consumer has a right to request a report of all the personal information collected, disclosed, or sold by a business.

The report must contain:

• Categories of personal information collected,
• Categories of sources,
• The business or commercial purpose for which the information was collected or sold,
• Categories of third parties who were sold/disclosed the personal information,
• Specific pieces of personal information collected by the business,
• Categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal information was sold, by category or categories of personal information for each category of third parties to whom the personal information was sold.
• The categories of personal information that the business disclosed about the consumer for a business purpose. 

This right applies only to personal information collected in the 12 months prior to the request and it cannot be exercised more than twice in a month.

Under CCPA, consumers have the right to data portability that ensures access to information in a portable and readily usable format and that allows consumers to transmit information to another entity.

Right to data portability is part of the right to access under CCPA and is therefore subject to the same limitations.