The terms “de-identified” and “deidentification” are commonly used in modern privacy statutes and are functionally exempt from most privacy- and security-related requirements. As indicated in the chart below, differences exist between how the term was defined in the California Consumer Privacy Act (CCPA) and how it was defined in later state privacy statutes set to go into force in 2023:
|
Requirement |
CCPA |
CPRA |
VCDPA |
CPA |
|
Technical safeguards. An organization must implement technical safeguards that prohibit reidentification. |
|
✘ |
✘ |
✘ |
|
Policy against reidentification. An organization must implement business processes that specifically prohibit reidentification. |
|
✘ |
✘ |
✘ |
|
Inadvertent release. An organization must implement processes to prevent inadvertent release of the deidentified information. |
|
✘ |
✘ |
✘ |
|
No reidentification. An organization must make no attempt to reidentify the information. |
|
✘ |
✘ |
✘ |
|
Data not reasonably associated to an individual. An organization must make a reasonable attempt to ensure that the data cannot be associated with specific individuals. |
✘ |
|
|
|
|
Public commitment. An organization must publicly commit (e.g., in its privacy policy) to maintain and use the information in deidentified form and not attempt to reidentify it. |
✘ |
|
|
|
|
Downstream recipient contracts. An organization must contractually obligate recipients of the information to abide by the same restrictions. |
✘ |
|
|
|
[1]FOOTNOTES
-
Cal. Civ. Code § 1798.140(h) (West 2020).
-
Cal. Civ. Code § 1798.140(h) (West 2020).
-
Cal. Civ. Code § 1798.140(h) (West 2020).
-
Cal. Civ. Code § 1798.140(h) (West 2020).
-
Cal. Civ. Code § 1798.140(m)(1) (West 2021).
-
Va. Code § 59.1-577(A)(1) (2021).
-
C.R.S. § 6-1-1303(11)(a) (2021).
-
Cal. Civ. Code § 1798.140(m)(2) (West 2021).
-
Va. Code § 59.1-577(A)(2) (2021).
-
C.R.S. § 6-1-1303(11)(b) (2021).
-
Cal. Civ. Code § 1798.140(m)(3) (West 2021).
-
Va. Code § 59.1-577(A)(3) (2021).
-
C.R.S. § 6-1-1303(11)(c) (2021).