CCPA Privacy FAQs: If a company receives a ‘right to be forgotten’ request from one consumer, does it have to delete information it obtained from other consumers in the same household?

No.

The CCPA states only that a business may have to delete the information that it obtained “from” the consumer that submits the right to be forgotten request.¹ As a result, if a business obtained information from two consumers that reside in the same household, and receives a right to be forgotten request from one of those consumers, it does not need to delete the information that it obtained from the other consumer. As an example, if two individuals in the same household signed up to receive advertising from a retailer by mail, and one of those individuals exercised their right to be forgotten, the retailer could continue to send advertisements to the second individual.

_______________________________________________

This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.

1. Id.

[View source.]