The CCPA contains several references to the obligation of a business to, in response to an access request, provide the “specific pieces of personal information” that it has collected about a California resident.¹ Each of those sections is modified by California Civil Code Section 1798.130(a)(2), which states that “the disclosure” required by a business in response to an access request “shall cover the 12-month period preceding the business’s receipt of the verifiable consumer request . . . .”² The statute reiterates that access is limited to a 12-month lookback in California Civil Code Section 1798.130(a)(3)(B) by stating that access requests that seek information about a business’s collection practices (as opposed to requests that seek the specific pieces of information held by the business) are similarly limited to “the preceding 12 months.”³

The CPRA amended the CCPA to require that the California Privacy Protection Agency adopt a regulation that establishes a standard by which a business could consider whether a request for information beyond the 12-month time period would be impossible or involve a “disproportionate effort.”⁴ Once the regulation is finalized, a consumer will be permitted to “request that the business disclose [specific personal information] beyond the 12-month period . . . .” ⁵ However, even when the regulation goes into effect (presumably in 2023), a business will still not be required to search for or produce personal information that was collected prior to Jan. 1, 2022.⁶

¹ Cal. Civ. Codes 1798.100(a), 100(c), 110(b) (October 2020); Cal. Civ. Code 1798.110(a)(5).

² Cal. Civ. Code 1798.130(a)(2) (Ocober 2020) (emphasis added).

³ Cal. Civ. Code 1798.130(a)(3)(B).

⁴ Cal. Civ. Code 1798.185(a)(9).

⁵ Cal. Civ. Code 1798.130(a)(2)(B).

⁶ Cal. Civ. Code 1798.130(a)(2)(B).