Data Deletion Seems Easy, But Complications Exist, IAPP Panelists Say
SAN DIEGO -- The right to delete seems simple, maybe deceptively so, though California's new Deletion Request and Opt-Out Platform (DROP) is attempting to reduce complications, panelists said during IAPP's privacy and security conference Friday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
While there are multiple states with comprehensive privacy laws, they seem to agree on the basics of deletion, said Julie Rubash, general counsel and chief privacy officer at Sourcepoint, a software company.
California, however, is “the only state that explicitly allows for de-identification or aggregation as a method of complying,” Rubash added, as well as having the Delete Act. Set to go live next year, DROP was created by the California Privacy Protection Agency (CPPA) as a one-stop shop for consumers and data brokers to facilitate deletion of information under the Act.
Houman Saberi, industry relations and operations lead at Consumer Reports (CR) Innovation Lab, noted that under the Act, a third party -- called an authorized agent -- can be tapped by a consumers to submit delete requests on their behalf.
California's deletion tools were created to simplify the process, Saberi said, echoing what Tom Kemp, executive director of the CPPA, said in an earlier conference session Friday: “What good are privacy rights if consumers can't exercise them?” (see 2510310032)
Still, deletion isn't always simple. For example, companies don't always store data in the same place. It could be housed with third parties and or across various systems, Rubash noted. Information is sometimes overcollected, she added, like during verification.
Appointed authorized agents help with communication and follow up with companies to make sure there is follow-through on requests, Saberi said.