1. Documentation
  2. Subject Rights (DSAR)

Personal Information and CCPA

What is PII under CCPA?

Personal information" in the CCPA is defined as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

Examples of personal data

Personal information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household:

  • Identifiers such as:
    • real name
    • alias
    • postal address
    • unique personal identifier
    • online identifier
    • internet Protocol address
    • email address
    • account name
    • social security number
    • driver’s license number
    • passport number
    • other similar identifiers.
  • Characteristics of protected classifications under California or federal law.
  • Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
  • Biometric information.
  • Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer interaction with an internet website, application, or advertisement.
  • Audio, electronic, visual, thermal, olfactory, or similar information.
  • Professional or employment-related information.
  • Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
  • Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

 

Examples of data not considered personal data

  • “Personal information” does not include publicly available information. Publicly available” means information that is lawfully made available from federal, state, or local government records. “Publicly available” does not mean biometric information collected by a business about a consumer without the consumer’s knowledge.
  • “Personal Information” does not include consumer information that is unidentified or aggregate consumer information. (from Section 1798.140(o)