Under the CCPA as amended by the CPRA, a customer says her stored address is wrong — how must the business decide and act?

## The right Under the CCPA as amended by the CPRA, Civil Code `1798.106(a)` gives a consumer the right to request that a business that maintains **inaccurate** personal information about them correct it, 'taking into account the nature of the personal information and the purposes of the processing'. On a verifiable request, `1798.106(c)` requires **commercially reasonable efforts** to correct it as directed, following `1798.130` and the regulations. The CCPA regulations fill that in at **11 CCR 7023**. ## How to decide: the totality of the circumstances Under 7023(b), the business considers the totality of the circumstances relating to the contested information, including: 1. **Its nature**: objective (a street address), subjective, unstructured or sensitive. 2. **How the business obtained it**: typed by the customer, bought in, inferred. 3. **Documentation** about its accuracy, from the consumer, the business or another source. The business **may deny** the request if the contested information is **more likely than not accurate** on that totality. If it is **not the source** of the information and has **no documentation** supporting it, the consumer's assertion of inaccuracy may be enough on its own (7023(b)(2)). For the stored address: if the old address came from a purchased mailing list and the customer says she moved, the business has no documentation of its own, and her statement can carry the request. ## Documentation rules - The business must **accept, review and consider** any documentation the consumer provides (7023(d)(1)). - It may **require** documentation only if needed to **rebut its own** documentation that the information is accurate, weighing the nature of the data, the quality of its own evidence, its purpose and the impact on the consumer (7023(d)(2)). - Documentation received may be used only to correct the information and for record-keeping, and must be kept securely (7023(d)(3)-(4)). ## How to act | Step | Source | |---|---| | Correct the information on existing systems | 7023(c) | | Instruct service providers and contractors holding it to correct theirs | 7023(c) | | Correct archived or backup copies when restored to an active system or next accessed or used | 7023(c) | | Tell the consumer whether the request was granted; explain any denial, with a detailed factual explanation for impossibility or disproportionate effort | 7023(f) | | On request, show her the specific pieces so she can confirm the fix; this does not count toward the twice-a-year limit on requests to know | 7023(j) | | Keep it corrected: an upstream feed must not silently overwrite the fix | 7023(k) | ## Alternatives and limits - **Deleting instead of correcting** is allowed only if deletion does **not negatively impact** the consumer, or she **consents**. The regulation's example: if deleting would make it harder to obtain a job, housing, credit or education, the business must correct or get consent (7023(e)). - **Repeat requests**: a business may deny a request to correct the **same alleged inaccuracy** it denied within the past **six months**, unless the consumer brings new or additional documentation (7023(g)). - **Fraud or abuse**: a good-faith, reasonable and documented belief that the request is fraudulent or abusive allows denial, with an explanation (7023(h)). - **Source disclosure**: where the business is not the source, it may tell the consumer where the alleged inaccuracy came from (7023(i)). - **Health data**: if it denies a correction of health information it collected and analysed, it must tell the consumer she may submit a written statement of up to **250 words** per alleged inaccuracy to be added to her record (7023(f)(3)). ## Why it is asked Correction is where data pipelines bite back. A fix made in the customer database but overwritten by the next import has not complied, and 7023(k) says so. Candidates should talk about propagating the change to service providers, flagging the corrected field as consumer-verified, and preventing a lower-trust source from overriding it.