CCPA Household Definition & Challenges
The CCPA includes a household within its definition of personal information. However, the household definition and inclusion in the text of the law presents problems for business in their compliance efforts with the California Consumer Privacy Act (CCPA). To put it plainly, there is not a definition yet and this could have important privacy implications concerning the right to access and the right to delete.
The lawmakers are aware of this problem and there is every reason to believe either the legislature or regulatory process (through the California Attorney General) will address it rather than require businesses to act in a manner that does not protect an individual’s privacy. But let us take a few minutes to look at how the CCPA household controversy.
Why is the definition of household important?
Households are included in the threshold for a covered business under the law. If a business alone or in combination, annually buys, receives, sells or shares the personal information of 50,000 or more consumers, households or devices, then the CCPA applies.
In addition, the definition of personal information under the California Consumer Privacy Act includes information that identifies or relates to a particular household. This means that the information must be provided or deleted under Sections 1798.100 or 1798.105.
Why was household included in the CCPA?
There has already been at least one proposed CCPA amendment to remove the term from California’s new privacy law. So why was it included? Many aspects of the text were written to attempt to limit circumvention by bad actors. This appears to be one such effort. It prevents businesses from claiming that it is not collecting information on a particular individual because any person located at the residence could be using the computer.
Why does the term household present a challenge?
First, the CCPA does not expressly define the term household, so until it is clarified a business needs to give it the broadest likely application as part of its compliance efforts. In other words, a business must assume that two individuals sharing an apartment that are not related are considered as within the same household for the purposes of the law.
Second, the term is not presently limited only to households within California. This could be a reasonable assumption since the term consumers that immediately proceeds it in the definition of personal information as well as the definition of business is limited to California residents. However, the annual revenue threshold is also not currently limited only to California revenue so this assumption is by no means safe at the moment.
What could household mean?
Here are a few possible definitions of household from dictionaries and other places:
Cambridge Dictionary: a group of people, often a family, who live together.
Google: a house and its occupants regarded as a unit.
Merriam-Webster Dictionary: those who dwell under the same roof and compose a family
Federal Health Insurance Marketplace: Tax filer plus spouse plus tax dependents.
Will household be removed from the CCPA?
For now, it appears that household will remain in the definition of personal information as AB 873 was approved by the Assembly Privacy and Consumer Protection Subcommittee with the suggested amendments. These amendments reincluded the term in the bill for fear of weakening the consumer protections of the CCPA. Instead, any concerns about the term household as it applies to the right to access and delete will be handled either by the California Attorney General rulemaking process or AB25 which declares an intent to provide the right to access in a privacy protective manner. It has already been suggested that there may need to be additional requirements for consumers to gain access to household information and these rules could be put in place by one or both places.
If there are updates to the CCPA household definition or regulations, we will post them here when they are available.
GET OUR FREE WHITE PAPER ON THE NEW CALIFORNIA LAW:
Additional Resources:
CCPA Summary
Data Portability for CCPA DSAR Access Responses
What is a CCPA business purpose or commercial purpose?
The Broad CCPA Definition of Sale
CCPA Definition of Consumer
CCPA Look Back Period Requirement
CCPA Training Requirement – Section 1798.130(a)(6)
CCPA Regulations: Coming Soon from the California Attorney General
Loyalty Programs, AB-846, and the CCPA Anti-Discrimination Clause