How to Verify Identity for CCPA Data Access Requests
Processing consumer data access requests is an essential part of CCPA compliance. In this post, we review what data access requests are and how to verify consumers with identity verification.
What Is CCPA?
The California Consumer Privacy Act (CCPA) is a law that gives California consumers more control over the personal information that businesses collect about them. Companies that do business in California and meet certain threshold requirements will have to comply with CCPA by following strict regulations about collecting personal data.
Businesses are subject to the CCPA if they exceed one or more of the following threshold requirements:
- Has gross annual revenues in excess of $25 million
- Buys, receives, or sells the personal information of 50,000 or more consumers, households, or devices
- Derives 50 percent or more of annual revenues from selling consumers’ personal information
Businesses that meet these threshold requirements but fail to comply can expect steep regulatory penalties.
What Are Data Access Requests?
One of the most significant provisions in the CCPA is data access requests. Section 1 of CCPA establishes that consumers have:
“The right to request that a business that collects a consumer’s personal information disclose to that consumer the categories and specific pieces of personal information the business has collected.”
Consumers have the right to request the following information in data access requests:
- The categories of personal information collected
- Specific pieces of personal information collected
- The categories of sources from which the business collected personal information
- The purposes for which the business uses the personal information
- The categories of third parties with whom the business shares the personal information
- The categories of information that the business sells or discloses to third parties
Consumers can also make requests for you to delete personal information. And you’ll need to provide all of this information free of charge. For firms with a considerable CCPA footprint, the costs of processing thousands of requests can add up.
Promptly, correctly and cost effectively completing data access requests is an essential part of CCPA compliance.
How to Verify Identity for CCPA Data Access Requests
To complete a data access request, you need to be sure that the consumer requesting the data is who they say they are, and that you disclose the personal information to the right consumer.
For most businesses with CCPA liability, the best way to validate these data access requests is through identity verification.
Identity verification technology uses identity data, identity documents and other methods to ensure your customers are who they say they are.
For CCPA compliance, identity verification ensures the person requesting the consumer data and the consumer are the same person. It does this by using existing consumer identity data and additional information to run a check of the requester’s identity. The verification technology then verifies that the requester and consumer are the same person, allowing you to fulfill the data access request.
Identity data is the primary method for verifying consumer identity. But in some cases, it will make sense to deploy more advanced verification methods, such as ID documents or biometrics.
Who Provides Identity Verification?
Identity verification providers offer CCPA compliance solutions that provide the identity verification technology you need to complete data access requests. But there are two ways you can access this technology.
First, CCPA compliance software providers offer identity verification integrations in their systems. This allows you to access verification methodologies and general compliance tools you need in one place.
Second, you can work directly with a verification provider through standalone CCPA compliance solutions. This allows you to verify consumer requests for data by integrating verification technology directly into your workflow. This delivery method is ideal for businesses that already have compliance software or are managing data access requests directly in their own systems.
Either way, deploying identity verification for CCPA is a straightforward process. First, you work with the provider to integrate the technology into your systems through an API. Then, you configure the criteria you’ll use for verifying consumer data requests. In most cases, you can complete onboarding and start verifying consumer identity in just a few days.
Conclusion
Verifying consumer identity for data access requests is an essential part of CCPA compliance. Fortunately, the availability of ID verification technology and compliance software has made it possible for any business to get CCPA compliant.
