TenthFleet:GDPR: Difference between revisions

Line 36:

===United States (California and other states)===

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. ~~Other US state~~ privacy laws ~~follow~~ a ~~similar pattern~~, ~~most exempting~~ non-profits ~~or applying~~ only above ~~commercial~~ thresholds. ~~Information drawn from~~ '''~~public records~~''' ~~is also typically outside~~ these ~~laws entirely~~.

California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.

California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:

* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''', commonly the personal data of 100,000 residents or more. A small volunteer hobby organization does not come close to those numbers, and so falls outside these laws in practice.

* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.

===Canada (PIPEDA)===

Line 68:

Line 72:

* [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk

* [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information

* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)

* [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada

* [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner

@@ Line 36: / Line 36: @@
 ===United States (California and other states)===
-California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Other US state privacy laws follow a similar pattern, most exempting non-profits or applying only above commercial thresholds. Information drawn from '''public records''' is also typically outside these laws entirely.
+California's Consumer Privacy Act, as amended by the California Privacy Rights Act, gives residents a '''right to delete''' personal information (Civil Code section 1798.105), subject to exceptions that preserve free speech and research in the public interest. Crucially, the Act applies only to a '''"business"''', defined as a '''for-profit''' legal entity that meets revenue or data-volume thresholds. A tax-exempt 501(c)(7) social club is not a for-profit business, so the CCPA and CPRA deletion right does '''not''' reach TRMN's member records. Information drawn from '''public records''' is also typically outside the law entirely.
+California was first, but by 2026 roughly nineteen states have comprehensive consumer-privacy laws, and every one of them includes a right to delete: '''Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, New Jersey, New Hampshire, Nebraska, Kentucky, Maryland, Minnesota, and Rhode Island''', alongside California. For TRMN, two features run through nearly all of them:
+* '''Non-profit treatment.''' Most of these laws exempt non-profit organizations outright, just as California does. A few do reach non-profits, notably '''Colorado, Oregon, Delaware, New Jersey, and Minnesota''' (some only in narrow categories such as insurance-fraud groups). But even in those states the law only applies above high '''thresholds''', commonly the personal data of 100,000 residents or more. A small volunteer hobby organization does not come close to those numbers, and so falls outside these laws in practice.
+* '''Deletion exceptions.''' Where any of them could apply, each carries the same kinds of exceptions California does, allowing personal data to be kept to comply with a legal obligation, to exercise or defend legal rights, for internal uses consistent with the context in which it was provided, and, in several, for public-interest or record-keeping purposes. A faithful historical archive fits comfortably within these.
 ===Canada (PIPEDA)===
@@ Line 68: / Line 72: @@
 * [https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/part/6/crossheading/archiving-in-the-public-interest Data Protection Act 2018, Schedule 2, Part 6 (Archiving in the public interest)], legislation.gov.uk
 * [https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.105&lawCode=CIV California Civil Code section 1798.105 (Right to delete, CCPA/CPRA)], California Legislative Information
+* [https://iapp.org/resources/article/us-state-privacy-legislation-tracker/ US State Privacy Legislation Tracker], International Association of Privacy Professionals (IAPP)
 * [https://www.priv.gc.ca/en/privacy-topics/privacy-laws-in-canada/the-personal-information-protection-and-electronic-documents-act-pipeda/ The Personal Information Protection and Electronic Documents Act (PIPEDA)], Office of the Privacy Commissioner of Canada
 * [https://www.oaic.gov.au/privacy/australian-privacy-principles Australian Privacy Principles], Office of the Australian Information Commissioner

TenthFleet:GDPR: Difference between revisions

MDGarcia (talk | contribs)