Searching…
The CCPA’s data minimization principle stems from the law’s general purpose and intent that businesses should collect consumers’ personal information only to the extent that it is relevant and limited to what is neces...
The California Consumer Privacy Act of 2018 as initially adopted (or subsequently amended until 2020) did not contain the principle of data minimization. A requirement to minimize data collection was, however, added b...
Data minimization is not addressed by most privacy laws in the United States, and it is not mandated by the CCPA. Unlike the CCPA, the California Privacy Rights Act of 2020 (the “CPRA”)...
What Is CPRA Data Minimization? Data minimization means limiting the Personal Information you collect, use, share, and store to what is reasonably necessary and proportionate to achieve the intended purpose. It means ...
Section 1798.100 (a) (1) and (2) of the CPRA present a limited "purpose limitation" obligation. First of all, you must disclose the purposes for which you collect or use each category of personal information and sensi...
Fast forward a couple of years and in late 2020, California voters approved Proposition 24, the CPRA, which amended the CCPA and added additional privacy protections that went into effect January 1, 2023. So what are ...
One key principle under the CCPA is limiting the collection of personal details to what is strictly necessary. Legacy systems, however, often pose unique challenges. These older frameworks may not be designed with mod...
In this installment of the CPRA Digest, we discuss the addition of purpose limitation and data minimization requirements and the implications for organizations trying to anticipate the impact of the CPRA.
For example, the Advisory identifies certain regulations that prohibit requiring consumers to provide “additional information beyond what is necessary” to exercise certain rights under the CCPA, including 11 CCR § 702...
As noted in the Enforcement Advisory, there are many obligations under the CCPA for which data minimization must be considered and applied, such as requests to opt-out of the sale or sharing of personal information, o...
