TenthFleet:GDPR: Difference between revisions

(2 intermediate revisions by one other user not shown)

Line 36:

===United States (California and other states)===

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. ~~Other US state~~ privacy laws ~~follow~~ a ~~similar pattern~~, ~~most exempting~~ non-profits ~~or applying~~ only above ~~commercial~~ thresholds~~. Information drawn~~ from '''~~public records~~''' is also ~~typically outside~~ these laws ~~entirely~~.

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.

California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:

* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''': typically the personal data of '''100,000 residents of that state''' in a year, dropping to 25,000 only for an organization that earns a quarter or more of its revenue from '''selling''' personal data. "Consumers" here means residents of the single state in question, so TRMN's members in any one state are a small fraction of its several-thousand worldwide membership, well under 100,000. TRMN also does not sell personal data, so the lower threshold cannot apply. It therefore falls below the applicability thresholds of these laws.

* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.

===Canada (PIPEDA)===

Line 68:

Line 72:

* [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk

* [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information

* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)

* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada

* [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner

[[Category:~~Policy~~]]

[[Category:Policies]]

[[Category:~~TenthFleet~~]]

[[Category:Tenth Fleet]]

@@ Line 36: / Line 36: @@
 ===United States (California and other states)===
-California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Other US state privacy laws follow a similar pattern, most exempting non-profits or applying only above commercial thresholds. Information drawn from '''public records''' is also typically outside these laws entirely.
+California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.
+California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:
+* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''': typically the personal data of '''100,000 residents of that state''' in a year, dropping to 25,000 only for an organization that earns a quarter or more of its revenue from '''selling''' personal data. "Consumers" here means residents of the single state in question, so TRMN's members in any one state are a small fraction of its several-thousand worldwide membership, well under 100,000. TRMN also does not sell personal data, so the lower threshold cannot apply. It therefore falls below the applicability thresholds of these laws.
+* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.
 ===Canada (PIPEDA)===
@@ Line 68: / Line 72: @@
 * [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk
 * [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information
+* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)
 * [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada
 * [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner
-[[Category:Policy]]
+[[Category:Policies]]
-[[Category:TenthFleet]]
+[[Category:Tenth Fleet]]

TenthFleet:GDPR: Difference between revisions

CMagnani (talk | contribs)