Cybersecurity Policy Report, CPPA Issues Enforcement Advisory on Data Minimization, (Apr 2, 2024)

By Tony Foley

The California Privacy Protection Agency issued its first enforcement advisory today, focused on the importance of data minimization under the California Consumer Privacy Act (CCPA).

Enforcement Advisory 2024-01 notes that data minimization is a foundational principle of the CCPA and that the CPPA’s implementing regulations underscore its importance. However, the CPPA Enforcement Division has observed that certain businesses are asking consumers to provide excessive and unnecessary personal information in response to consumer requests made under the CCPA. The advisory reminds businesses to apply the data minimization principle to each purpose for which they collect, use, retain and share consumers’ personal information, including information that businesses collect in connection with such a consumer request.

The advisory outlines what the CCPA and its implementing regulations say about data minimization, as well as highlighting adjacent regulations that reflect the data minimization concept, like provisions governing opt-out preference signals and limitations on the use and disclosure of sensitive personal information, among others. It also provides factual scenarios in which the data minimization principle might be encountered in responding to consumer requests, including processing a consumer request to opt out of sale or sharing, as well as verifying a consumer’s identity pursuant to a requested deletion of personal information.

With respect to enforcement advisories generally, the CPPA clarified that they were designed to address selected provisions of the CCPA and its implementing regulations and didn’t cover all potentially applicable laws or enforcement circumstances. Advisories do not establish substantive policy or rights, constitute legal advice, or reflect the views of the CPPA board, the agency said.

In addition, advisories don’t provide any bases for alternative relief or safe harbor from potential violations, it said.

News: StateLegislation DataPrivacy CCPA