What is a CCPA business purpose or commercial purpose?
The California Consumer Protection Act (CCPA) requires covered businesses to disclose the business or commercial purpose for collecting or selling personal information. For businesses to comply, they will need to determine the business purpose or commercial purpose which they need to disclose.
The CCPA defines both “business purpose” and “commercial purposes” in Section 1798.140.
CCPA Business Purpose
Business purpose is defined as “the use of personal information for the business’s or a service provider’s operational purposes, or other notified purposes, provided that the use of personal information shall be reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected.”
The CCPA lists 7 categories of business purposes in section 1798.140. In short, they are:
1. Auditing Interactions with Consumers
2. Security
3. Debugging/Repair
4. Certain Short-term Uses
5. Performing Services
6. Internal Research for Tech Development
7. Quality and Safety Maintenance and Verification
Auditing includes counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and other compliance auditing with regard to concurrent transactions.
Security involves detecting security incidents, protecting against malicious or fraudulent activity, and prosecuting offenders.
Debugging relates to the identification and repair of impairments to intended, existing functionality.
Short-term, transient uses are a business purpose provided that the personal information is not disclosed to another third party, not used to build a profile about a consumer, or alter an individual’s experience outside the current transaction (including contextual ads as part of the same interaction).
The services performed may be either by the business or a service provider. These services include “maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services.
There is not too much more to the internal research business purpose. It allows research into technological development and demonstration.
The quality and safety business purpose includes activities related to the improvement, upgrade or enhancement of the service or device owned, manufacturered, manufactured for, or controlled by the business. It also includes the verification or maintenance of the quality or safety of a service or device.
The term business purpose is used in the definition of research, sale, service provider and third party.
CCPA Commercial Purpose
Commercial purposes is defined as a means “to advance a person’s commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.” Commercial purposes do “not include for the purpose of engaging in speech that state or federal courts have recognized as noncommercial speech, including political speech and journalism.”
There is no list of commercial purposes similar to the list of seven business purposes. The precise delineation between a commercial purpose and a business purpose at some times may also be unclear or overlapping, due to the breadth of the definition of commercial purposes and the possibility of dual purposes.
In addition to the disclosures that must be made to consumers about the collection and use of personal information, the term comes into play in the definition of a business, service provider, third party and research.
GET OUR FREE WHITE PAPER ON THE NEW CALIFORNIA LAW:
Additional Resources:
CCPA Summary
Data Portability for CCPA DSAR Access Responses
The Broad CCPA Definition of Sale
CCPA Definition of Consumer
CCPA Look Back Period Requirement
CCPA Household Definition & Challenges
CCPA Training Requirement – Section 1798.130(a)(6)
CCPA Regulations: Coming Soon from the California Attorney General
Loyalty Programs, AB-846, and the CCPA Anti-Discrimination Clause