Can the CCPA Access Right Be Saved? Realigning Incentives in Access Request Verification

Authors

  • Rebecca Iafrati

DOI:

https://doi.org/10.5195/tlp.2020.232

Abstract

The California Consumer Privacy Act access right has the potential to give Californians a level of control over their personal information that is unprecedented in the United States. However, consumer privacy interests will be in peril unless the access right is accompanied by an effective access request verification requirement. Requiring companies to respond to access requests when they cannot verify that the requestor is the subject of the requested data puts sensitive personal information at risk. Inversely, allowing companies to shirk their access request responsibilities by claiming that data is unverifiable diminishes consumers’ data control rights. Thus, in the context of access request verification policy, there is an inherent tension between privacy as confidentiality and privacy as control. The success of the access right, and thus all CCPA data control rights, hinges on an access request verification policy that successfully balances these competing privacy interests. The endemic identity theft caused by credit application verification systems demonstrates why such balancing cannot be wholly left to private companies. In the credit context, balancing has been driven by the profit maximization interests of businesses, which currently do not align with consumer privacy interests. Fortunately, several scholars have proposed methods for aligning these divergent interests. The strengths and weaknesses from these proposed solutions to identity theft provide a useful framework for building a system that incentivizes companies to prioritize consumer privacy when developing access request verification systems.

Author Biography

Rebecca Iafrati

Georgetown University Law Center, J.D. Candidate 2020; Tufts University B.A. 2016. Thank you to Professor Julie Cohen for helping me through every step of the writing process. Thank you also to Professor Alexandra Givens for introducing me to the world of technology law and policy.

Downloads

Published

2020-02-12

How to Cite

Iafrati, R. (2020). Can the CCPA Access Right Be Saved? Realigning Incentives in Access Request Verification. Pittsburgh Journal of Technology Law & Policy, 20(1). https://doi.org/10.5195/tlp.2020.232

Issue

Vol. 20 No. 1 (2020)

Section

Articles

License


Authors who publish with this journal agree to the following terms:

    1. The Author retains copyright in the Work, where the term “Work” shall include all digital objects that may result in subsequent electronic publication or distribution.

    2. Upon acceptance of the Work, the author shall grant to the Publisher the right of first publication of the Work.

    3. The Author shall grant to the Publisher and its agents the nonexclusive perpetual right and license to publish, archive, and make accessible the Work in whole or in part in all forms of media now or hereafter known under a Creative Commons 4.0 License (Attribution-Noncommercial-No Derivative Works), or its equivalent, which, for the avoidance of doubt, allows others to copy, distribute, and transmit the Work under the following conditions:
      1. Attribution—other users must attribute the Work in the manner specified by the author as indicated on the journal Web site;
      2. Noncommercial—other users (including Publisher) may not use this Work for commercial purposes;
      3. No Derivative Works—other users (including Publisher) may not alter, transform, or build upon this Work,with the understanding that any of the above conditions can be waived with permission from the Author and that where the Work or any of its elements is in the public domain under applicable law, that status is in no way affected by the license.

    4. The Author is able to enter into separate, additional contractual arrangements for the nonexclusive distribution of the journal's published version of the Work (e.g., post it to an institutional repository or publish it in a book), as long as there is provided in the document an acknowledgement of its initial publication in this journal.

    5. Authors are permitted and encouraged to post online a pre-publication manuscript (but not the Publisher’s final formatted PDF version of the Work) in institutional repositories or on their Websites prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work. Any such posting made before acceptance and publication of the Work shall be updated upon publication to include a reference to the Publisher-assigned DOI (Digital Object Identifier) and a link to the online abstract for the final published Work in the Journal.

    6. Upon Publisher’s request, the Author agrees to furnish promptly to Publisher, at the Author’s own expense, written evidence of the permissions, licenses, and consents for use of third-party material included within the Work, except as determined by Publisher to be covered by the principles of Fair Use.

    7. The Author represents and warrants that:

      1. the Work is the Author’s original work;
      2. the Author has not transferred, and will not transfer, exclusive rights in the Work to any third party;
      3. the Work is not pending review or under consideration by another publisher;
      4. the Work has not previously been published;
      5. the Work contains no misrepresentation or infringement of the Work or property of other authors or third parties; and
      6. the Work contains no libel, invasion of privacy, or other unlawful matter.
         
    8. The Author agrees to indemnify and hold Publisher harmless from Author’s breach of the representations and warranties contained in Paragraph 6 above, as well as any claim or proceeding relating to Publisher’s use and publication of any content contained in the Work, including third-party content.