CCPA Fast Track Implementation Guide for Consumer Rights

Consumer Persona

It is most helpful to begin with identifying the persona of your consumer audience who will be submitting consumer rights requests. Usually, different data is specific and pertains to different types of individuals. This will then affect the verification and fulfillment process your privacy program will choose to implement. For example, is this person a customer or a contractor? Will you be opening up this process to employees? Is this person an account holder, or do they own something like an order number that can be verified?

Request Verification

This step is usually determined based on the persona of the individual and the nature of the data that you possess. The California Attorney General has outlined guidance in the finalized regulations on how to verify identity. Common approaches include the following:

• Channel verification (verifying the email used to make the request)

• Checking a combination of known data points collected on the web form

• Integrations with third-party identity providers for verification (advanced implementation).

Request Fulfillment

Request fulfillment begins with identifying who will be retrieving or acting upon data to fulfill these requests. Have you identified members of your IT team or system admins who can access the appropriate data sets? Will there be a final review before sending the requests?

Response Templates

The finalized regulations from the California Attorney General have set new timelines for confirm the receipt of requests. Often times it is useful to organize these responses in templates. The information provided in the response should generally describe the business’s request verification process, as well as when the individual should expect a substantive response.

Web Form Configuration

The first step in configuring your Consumer Rights module is setting up your request intake method. To do this, navigate to the Web Forms screen and select the Add New button to begin setting up the California (CCPA Fast Track) template. Ensure that you select the seeded CCPA Workflow during this initial setup. For more information, see Creating a Web Form.

You can use the CCPA Fast Track template to create a dynamic form with built-in guidance text and configuration support for requests submitted by consumers under the California Consumer Privacy Act (CCPA). There are a few key areas that you can focus on when setting up this form. You will notice that by default, the styling is set to OneTrust and the links in the welcome text link to OneTrust policies. This can all be updated in the Web Form Customization screen.

First, select Form Text on the customization sidebar to edit Welcome Text and Footer Text accordingly. The Privacy Overview and Full Privacy Notice links in the Welcome Text should be updated with links to your organization's notices or removed altogether. Additionally, the Footer Text's default filler address and contact method will need to be updated with your organization's respective information. Form Styling contains customization options for header logos, in addition to header and button color options.

The CCPA Fast Track template is also set up to automatically perform email verification and route requests to specified workflows based on request type (Access, Deletion, and Opt-Out of Sale). For more information on how to configure web form templates, see Customizing a Web Form.

Once you have configured your web form, you can progress to setting up your workflows. When you are ready for go live, you can integrate this form onto your site. To do so, click the Publish button to obtain a link that can be placed on your website. This link will also be accessible in the Integrate tab in the Web Form Customization screen. For more information, see Generating a Web Form Link.

Workflows

Your OneTrust account will come seeded with preconfigured workflows for your request processes. By default there will be a general CCPA workflow supported for Access, Deletion, or Opt-Out requests. For information on how to configure workflows, see Customizing a Workflow.

Each seeded workflow is configured with stages, as necessary, for request verification, request fulfillment, and a final review before completing the request. Additionally, these seeded workflows support subtask configuration by state. These scan translate to an action or task that privacy team members need to perform per stage. Below are some recommendations when configuring subtasks in workflows:

• Subtasks for request verification should be assigned to the individual (if manual) managing the request. This person is responsible for ensuring that your verification processes are done. For example, verifying that information gathered on the web form is correct and matches the information that you also have on the individual.

• Subtasks for request fulfillment are usually assigned to system admins of systems that hold personal information or members of the IT organization. These individuals are responsible for pulling, actioning, and retrieving the information that is in scope for a certain requests. Additionally, they may understand technical implications of the tools that they use. For example, if a deletion can happen or not. 

• Subtasks at the legal/privacy review stage are generally for the legal, privacy, or compliance person. This is best left to individuals that will understand where legal exceptions may occur and can perform a final review of a request before it is completed.

Response Templates

OneTrust Consumer Rights seeds response templates that can be sent through our secure messaging portal. These are designed to ensure that communication with the individual is in agreement with your organization's legal messaging and to reduce time spent crafting messages for each interaction. The list of available templates can be seen and further customized in the Response Templates screen. For more information on how to edit these templates, see Using Response Templates.