If a Company receives a request for deletion request under the CCPA, can it ask the consumer to confirm what information should be deleted?

Yes. 

In fact, businesses may be required to obtain such confirmation from verified consumers under the current (non-final) regulations.  As an initial matter, the CCPA states only that a business may have to delete the information that it obtained “from” the consumer.  As a result, if a business obtains information about a consumer from other sources (e.g., third party data brokers) or develops the information from its own experiences with the consumer (e.g., transactional information), arguably that information does not have to be deleted pursuant to a deletion request.  Moreover, the request for deletion itself is subject to a number of exceptions and qualifications.  But assuming that a valid, verified request for deletion is submitted to a business, the business likely does have the ability to ask the consumer to confirm what information should be deleted. 

Current (non-final) regulations proposed by the California Attorney General endorse this approach.  Proposed Regulation 999.312(d) provides that “[a} business shall use a two-step process for online requests to delete where the consumer must first clearly submit the request to delete and then second separately confirm that they want their personal information deleted.”  And Proposed Regulation 999.313(d)(7) states that “[i]n responding to a request to delete, a business may present the consumer with the choice to delete select portions of their personal information only if a global option to delete all personal information is also offered, and more prominently presented than the other choices.”  Taken together, these regulations approve verification of the consumer’s choice regarding what information should be deleted before deletion, as long as the option to delete all information is presented more prominently than other choices.  While the proposed regulations are silent as to what makes presentation of a particular choice “more prominent[],” it does appear that the presentation of a choice regarding deletion of some or all data collected from an individual is permitted prior to fulfillment of the request.

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes.  You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide.