Remove tag record-retention-2
article thumbnail

$10,000,000 civil penalty for disclosing personal data without consent

Data Protection Report

The order also requires that the company destroy personal data for which it had not received consent and to create a document retention and destruction policy. The order also, in Section IX, set forth data destruction requirements and a data retention policy.

article thumbnail

California Consumer Privacy Act: GDPR-like definition of personal information

Data Protection Report

The CCPA defines “[p]ersonal information” as any information that “identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Reexamine the company’s methods for creating de-identified or anonymous sets of data.

GDPR 40