Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party customer service tools that collect personal information in California? What are the requirements?

Using Third-Party Customer Service Tools that Collect Personal Information in California

If you are using third-party customer service tools that collect personal information in California, you must ensure that the tools comply with the requirements of the California Consumer Privacy Act (CCPA) [1.1][2.2].

Under the CCPA, a business that collects personal information from California consumers must provide a Notice at Collection that informs consumers about the categories of personal information to be collected, the purposes for which the personal information is collected or used, and whether that information is sold or shared [2.2]. The Notice at Collection must be made readily available where consumers will encounter it at or before the point of collection of any personal information [2.2].

If you are using third-party customer service tools that collect personal information, you must ensure that the tools provide a Notice at Collection that complies with the CCPA [2.2]. The Notice at Collection must be made readily available where consumers will encounter it at or before the point of collection of any personal information [2.2].

Additionally, the collection, use, retention, and/or sharing of a consumer’s personal information by a business must be reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed, which shall comply with the requirements set forth in 11 CACR Section 7002 [2.1].

If the third-party customer service tool is a service provider or contractor, the contract required by the CCPA for service providers and contractors must prohibit the service provider or contractor from selling or sharing personal information it collects pursuant to the written contract with the business [1.1]. The contract must also require the service provider or contractor to comply with all applicable sections of the CCPA and these regulations, including providing the same level of privacy protection as required of businesses by the CCPA and these regulations [1.1].

If a business has an established business relationship with a customer and has within the immediately preceding calendar year disclosed personal information that corresponds to any of the categories of personal information set forth in paragraph (6) of subdivision (e) to third parties, and if the business knows or reasonably should know that the third parties used the personal information for the third parties’ direct marketing purposes, that business shall, after the receipt of a written or electronic mail request, or, if the business chooses to receive requests by toll-free telephone or facsimile numbers, a telephone or facsimile request from the customer, provide all of the following information to the customer free of charge [3.1].

In summary, if you are using third-party customer service tools that collect personal information in California, you must ensure that the tools provide a Notice at Collection that complies with the CCPA, and the collection, use, retention, and/or sharing of a consumer’s personal information by a business must be reasonably necessary and proportionate to achieve the purpose(s) for which the personal information was collected or processed [1.1][2.1][2.2]. If the third-party customer service tool is a service provider or contractor, the contract required by the CCPA for service providers and contractors must also comply with the CCPA [1.1].

Source(s):
Jurisdiction

California