Under the CCPA, what can a consumer learn through the right to know, and how do 'categories' differ from 'specific pieces' of personal information?

## Two sections, one right Under the CCPA as amended by the CPRA, the **right to know** is split across two Civil Code sections: - `1798.110` covers what a business **collects**: a consumer may request the categories of personal information collected about them, the categories of sources, the business or commercial purpose for collecting, selling or sharing it, the categories of third parties to whom the business discloses it, and **the specific pieces** of personal information collected. - `1798.115` covers what a business **passes on**: the categories it sold or shared and the categories of third parties that received each, and the categories it disclosed for a business purpose and the categories of persons that received them. `1798.130(a)(4)` requires the sold-or-shared list and the business-purpose list to be kept separate. ## What a categories answer contains A categories answer is a **description**, not a copy. It must: 1. Use the enumerated categories of `1798.140(v)(1)`, as `1798.130(c)` requires: identifiers, commercial information, internet activity, geolocation data, inferences and the rest, plus the sensitive-personal-information categories of `1798.140(ae)`. 2. Name the categories of sources (the consumer's device, the mobile app, a partner) and the purposes. 3. Name the categories of third parties, and for sold, shared or business-purpose disclosures, which category went to which category of recipient. 4. Be **individualised**. Under 11 CCR 7024(j), a business may point to its privacy policy only if its answer would be the same for every consumer and the policy discloses everything the answer must contain. 11 CCR 7024(l) adds that the categories must give the consumer a **meaningful understanding** of what is listed. ## What specific pieces are Specific pieces are the **actual values** held about the consumer. For a fitness-tracker company: | Statutory category (1798.140(v)(1)) | A categories answer says | A specific-pieces answer delivers | |---|---|---| | Identifiers (A) | 'Identifiers such as email address and device identifier' | Her email address and the tracker's device identifier | | Geolocation data (G) | 'Geolocation data from recorded workouts' | The GPS tracks of her runs | | Commercial information (D) | 'Purchase history of devices and subscriptions' | Her order and subscription records | | Inferences (K) | 'Inferences about fitness level and habits' | The fitness score and activity profile computed about her | The disclosure must cover personal information collected **directly or indirectly**, including through a service provider or contractor (`1798.130(a)(3)(A)`). ## What is never sent back verbatim The regulations keep certain values out of the response entirely. Under 11 CCR 7024(d), a business must **not** disclose, in response to a request to know: - a Social Security number, driver's licence number or other government-issued identification number; - a financial account number, or a health insurance or medical identification number; - an account password or security questions and answers; - unique biometric data generated from measurements or technical analysis of human characteristics. Instead, it must say with sufficient particularity that it holds that **type** of information; the regulation's own example is answering that it collects 'unique biometric data including a fingerprint scan' without sending the scan. Separately, `1798.130(a)(3)(B)(iii)` says specific pieces do not include data generated to help ensure security and integrity. ## Limits a candidate should know - **Frequency.** Under `1798.130(b)`, a business need not answer the same consumer's requests under `1798.110` and `1798.115` more than twice in a 12-month period. - **Partial denials.** If an exception or a conflicting law blocks part of a request for specific pieces, 11 CCR 7024(e) requires the business to explain the basis and still disclose the rest. - **Transmission.** 11 CCR 7024(f) requires reasonable security when transmitting the personal information to the consumer. ## Why interviewers ask it The distinction decides what an engineering team must build. A categories answer can be generated from a data inventory that maps each store to statutory categories, sources, purposes and recipients. A specific-pieces answer needs a per-consumer **lookup across every store** that holds her data, including those run by service providers, with a filter that withholds the protected types. Candidates who describe only one of the two have described half the right.