California Consumer Privacy Act
- Frequently Asked Questions -

Last Updated Date: December 20, 2019

This FAQ is intended for Balboa Digital's Clients. If you are a consumer, please see Balboa Digital's Privacy Policy for information about your CCPA rights as they relate to Balboa Digital's services.

This FAQ is for informational purposes only. It is intended to provide information on Balboa Digital's approach to addressing the potential obligations imposed by the CCPA on Balboa Digital's business model. It is not intended to provide legal or business advice to any other company or individual. The obligations imposed by the CCPA depend on how your company collects and uses personal information and you are solely responsible for seeking your own advice as needed for your company's compliance needs under the CCPA or otherwise.

1. What is the CCPA?

The California Consumer Privacy Act (CCPA) is a comprehensive privacy law that comes into effect on January 1, 2020. The law is enforced by the California Attorney General (AG), who is also tasked with issuing regulations under the CCPA. Enforcement can begin six months after the AG issues final regulations or on July 1, 2020, whichever is sooner. The CCPA applies across all industry sectors, imposing obligations on companies that handle personal information. The CCPA's requirements include:
  • Providing privacy notices
  • Implementing processes for individuals to access and delete their personal information
  • Allowing individuals to opt out from "sales" of their personal information
The "sale" opt out right impacts more than just traditional sales of data for money. The CCPA defines "sale" broadly to include many commonplace data sharing arrangements, even where no money is exchanged. However, data sharing with a business's service provider is not considered a "sale," as long as certain contractual terms are in place between a business and its service provider.

2. How is Balboa Digital preparing for the CCPA?

Balboa Digital has assessed its obligations under the CCPA. Among other activities, Balboa Digital has prepared processes for receiving and responding to consumer rights requests we may receive. And, we have revised applicable privacy policies and contracts to better align with applicable CCPA requirements.

3. How can our Clients continue to use Balboa Digital's services consistent with the CCPA?

As currently defined under the CCPA, a "service provider" processes California consumers' personal information on behalf of another business. To be a service provider, the entity must receive the personal information under a written contract that limits the service provider's processing to purposes specified in the contract or otherwise permitted by the CCPA. A "business" is a for-profit entity that determines the purposes and means of processing California consumers' personal information and that meets certain thresholds around revenue and similar factors. Balboa Digital acts as a service provider and our Client's privacy policies determine how we handle Consumer PI, as defined and detailed in our Privacy Policy, that you own and provide to us, requiring us to follow your instructions. If you pass along to us (1) a Request to Know, (2) a Request to Delete, or (3) a Request to Opt Out of Data Sales, we will acknowledge and process the request within the time frame allowed in CCPA regulations. Likewise, if one of your consumers directly submits a request to us, we will process their request and notify you so that you can process according to your internal policies and procedures. Regarding a Request to Know, our policy, consistent with CCPA requirements, is to provide a list and count of the data elements and data types captured in our database. We do not disclose the actual values of the data elements. Regarding a Request to Delete, our policy is to anonymize the consumer record to obfuscate the consumer's name, specific location, email address, telephone in a manner allows the record of the consumer's existence to be included in Derived Data (per our Privacy Policy), but the remaining source record data will not be individually identifiable as an individual Consumer's PI. Any additional Consumer PI present, such as government identifiers, financial account numbers or similar sensitive Consumer PI, will be completely deleted. Regarding a Request to Opt Out of Data Sales, our Clients own the data that we utilize or collect to provide our services. We do not sell or receive any in-kind value or consideration for the consumer data that we manage for Clients. We will respond to these requests with this statement.

4. What else do I need to know?

Balboa Digital:
  • Internal policy and procedure have been established to handle CCPA-related requests which includes communications with our Clients.
  • A web form, email address and unique phone number have been established to accept CCPA-related requests from Clients and consumers.
  • It is our policy to treat CCPA-like requests from all United States of America and Canada residents consistent with California residents up until the point where regulation outside of California may compel us to update our policy further so that it can be applied on a nationwide-basis for United States of America and Canada.
  • We will notify you of any additional changes to our CCPA practices and Privacy Policy, should they occur.
  • On an annual basis, Balboa Digital will publish CCPA request statics on our website per CCPA requirements.
Please visit our Privacy Policy for more information and resources.