Remove tag record-retention-2
article thumbnail

$10,000,000 civil penalty for disclosing personal data without consent

Data Protection Report

The order also requires that the company destroy personal data for which it had not received consent and to create a document retention and destruction policy. Its privacy policy stated that the company would treat the data confidentially, and the company would not share data without user consent.

article thumbnail

California Consumer Privacy Act: GDPR-like definition of personal information

Data Protection Report

The California Consumer Privacy Act (“CCPA” or the “Act”) sets a new precedent with its sweeping definition of Personal Information (“PI”). First, PI does not include any “publicly available” information that is lawfully made available from federal, state, or local government records. Article #2: CCPA Covered Entities.

GDPR 40