Cal. Code Regs. Tit. 11, § 7053 - Contract Requirements for Third Parties
(a) A business that sells or shares a
consumer's personal information with a third party shall enter into an
agreement with the third party that:
(1)
Identifies the limited and specified purpose(s) for which the personal
information is made available to the third party. The purpose(s) shall not be
described in generic terms, such as referencing the entire contract generally.
The description shall be specific.
(2) Specifies that the business is making the
personal information available to the third party only for the limited and
specified purpose(s) set forth within the contract and requires the third party
to use it only for that limited and specified purpose(s).
(3) Requires the third party to comply with
all applicable sections of the CCPA and these regulations, including--with
respect to the personal information that the business makes available to the
third party--providing the same level of privacy protection as required of
businesses by the CCPA and these regulations. For example, the contract may
require the third party to comply with a consumer's request to opt-out of
sale/sharing forwarded to it by a first-party business and to implement
reasonable security procedures and practices appropriate to the nature of the
personal information to protect the personal information from unauthorized or
illegal access, destruction, use, modification, or disclosure in accordance
with Civil Code section
1798.81.5.
(4) Grants the business the right--with
respect to the personal information that the business makes available to the
third party--to take reasonable and appropriate steps to ensure that the third
party uses it in a manner consistent with the business's obligations under the
CCPA and these regulations. For example, the business may require the third
party to attest that it treats the personal information the business made
available to it in the same manner that the business is obligated to treat it
under the CCPA and these regulations.
(5) Grants the business the right, upon
notice, to take reasonable and appropriate steps to stop and remediate
unauthorized use of personal information made available to the third party. For
example, the business may require the third party to provide documentation that
verifies that it no longer retains or uses the personal information of
consumers who have had their requests to opt-out of sale/sharing forwarded to
it by the first party business.
(6)
Requires the third party to notify the business after it makes a determination
that it can no longer meet its obligations under the CCPA and these
regulations.
(b) Whether
a business conducts due diligence of the third party factors into whether the
business has reason to believe that the third party is using personal
information in violation of the CCPA and these regulations. For example,
depending on the circumstances, a business that never enforces the terms of the
contract might not be able to rely on the defense that it did not have reason
to believe that the third party intends to use the personal information in
violation of the CCPA and these regulations at the time the business disclosed
the personal information to the third party.
Notes
Note: Authority cited: Section 1798.185, Civil Code. Reference: Sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.121, 1798.130, 1798.135, 1798.140 and 1798.185, Civil Code.
State regulations are updated quarterly; we currently have two versions available. Below is a comparison between our most recent version and the prior quarterly release. More comparison features will be added as we have more versions to compare.
No prior version found.