Consumer Request Channel

00:01

Welcome everyone. Toe Lesson 8.3

00:03

We are now going to discuss the Consumer Request Channel.

00:07

This is how your organization will receive and operationalize all of those consumer requests that you might be receiving. Because the residents of California now have the ability to access delete an opt out of the sale of their information.

00:21

Let's jump right into it

00:23

the learning goals and objectives for less than 8.3.

00:26

First,

00:27

we will review the standard timeline for fulfilling a consumer request.

00:31

Secondly,

00:32

we will review the various factors to evaluate when designing your own consumer request channel.

00:38

Then item number three.

00:40

We will look at different consumer requestion all models

00:44

you might recall. In the last lesson, I said we were going to look at Riel World examples.

00:49

We will be doing that in this lesson here now, and we're also going to in less than 8.4.

00:54

Let's jump into it.

00:56

This is the timeline of your standard consumer request.

00:59

Remember, under the CCP A. You have 45 days to respond to an individual's consumer request

01:06

once you receive it.

01:07

Day one,

01:08

let's look at the first item there.

01:11

You've received your consumer request.

01:12

You absolutely need to perform what is called verification exercises. You must be able to verify the identity of the consumer.

01:22

Please be aware that there are a growing number of fraudulent consumer requests that bad actors air now submitting to get the personal information of individuals.

01:30

Essentially, they're weaponizing the CCP A against the very individuals that it's supposed to protect.

01:38

Any consumer request channel needs to have an identity verification mode built into it. So there's various ways of ensuring someone's identity as they, in fact being the person that they represent themselves to be,

01:51

feel free to go on to the market and look,

01:53

there's some best practices, including getting additional information. If need to be phone calls, have them confirm what middle school they grew up at, etcetera.

02:01

You're familiar with the security questions

02:05

moving forward, though,

02:07

as the timeline continues, you must be able to begin compiling the information that is requested

02:13

or in the alternative, deleting and opting out of the sale of that information.

02:16

You need to pull it off all within the 45 days because you must return the completed consumer request back to the consumer within those 45 days

02:27

or in the alternative request that you receive an additional 45 days, but you have to do it within the first window. Alternatively, it would just be a 90 day window.

02:38

Please be aware that you do need to the moment you receive your consumer request. Very frankly,

02:43

immediately begin addressing the request itself.

02:46

There is no specific method of capture that necessarily works for every single company.

02:52

No size fits all.

02:53

You basically need to have some general rules to follow.

02:57

For starters,

02:58

number one,

03:00

your business needs to develop some sort of project management solution or tool.

03:04

It doesn't even need to be software, necessarily.

03:07

It could just be an internal process, which basically needs patients. Coffee in a spreadsheet. Okay,

03:13

you just need to be able to track various items and be able to take it them in a way that's organized because

03:19

you're going to be progressing through and receiving multiple requests simultaneously.

03:23

I strongly believe it's unlikely that you're going to get one consumer request every quarter or so.

03:29

That's not what I'm seeing the market. And that's not what other privacy professionals are seeing, either.

03:34

The number of requests will absolutely drive the type of consumer requestion will you build.

03:38

Of course, that's dependent upon your type of business model.

03:43

There's generally four different types of consumer request channels.

03:46

We will introduce you to the first one here. Now

03:50

the other three arm or high volume consumer requests will address those in lessons 8.4

03:57

without further ado.

03:58

Example, One is simply nothing more than just having an interactive email address.

04:02

You incorporate this email address into your privacy policy

04:06

that works fine.

04:08

Statistically, approximately 50% of the businesses out there have little more than just an interactive email address that can receive a consumer request.

04:16

You go to someone's privacy policy, pick your favorite company.

04:19

There's a 50 50 shot. They are using this methodology.

04:25

If you look at item, too,

04:27

they do little more than just build a new email address.

04:30

It could be privacy at the name of the business dot com.

04:32

Then someone on the receiving end of that email is then able to address the consumer request and make sure it gets satisfied.

04:40

They frequently used the inbox for that very email as the ticket management solution

04:46

again. It's

04:46

very low tech, and it's very rudimentary.

04:49

The reason that works is. And if you look at item number three, generally a businesses who use this type of solution are Onley receiving less than five consumer requests a month.

05:00

If you are getting more than that,

05:01

this solution is not going to work for you because you're gonna have too many things to keep track off.

05:08

Also,

05:09

let me point out, the CCP requires you to also provide a toll free number in order to effectuate a CCP a consumer request.

05:16

You need to build out the capability to have that toll number line, man.

05:20

What we recommend is you have someone trained.

05:24

It could be someone in customer service wherever to understand the nature of the request.

05:29

Then that individual in

05:30

Let's Go with customer service.

05:32

Well, then email the privacy at business dot com address,

05:36

thereby capturing the request and then sending it back to the individual who called in.

05:44

Basically, the reason why the toll free number was included was because there was a concern by privacy advocates that seniors and other individuals who are less familiar with technology would not be able to fill out a request online.

05:57

If you go to any government website, in fact, is a great example. Try registering to vote in whatever state you live.

06:02

You will see that there's a similar mechanism where there's toll free numbers available,

06:08

concluding lesson 8.3 here,

06:10

number one.

06:11

Your consumer Request channel timeline needs to be appreciated. You cannot ignore it because if you fall out of the 45 day window, you will be violating the specific obligations that your company has set upon itself because it does business for California residents, therefore exposing you to potential non compliance with the California Attorney General.

06:31

Please make sure you can pull this off within 45 days.

06:34

There are various what we're calling here. Low cost models for fielding and addressing consumer requests.

06:42

Make sure that the email address is actually functional that you tested out beforehand.

06:46

Believe it or not, I had one client who had an email address, but it was never actually viewed by anyone.

06:53

It just went into some inbox black hole. So

06:56

test it out, Please.

06:58

The only way you're really going to pull this off if you're doing again. Less than five consumer requests a month is using, as I mentioned there ah, lot of patients.

07:05

It's going to have to be micromanaged because you're going to be getting requests from individuals to have their information deleted and or in the alternative, they might be asking for opt outs of the sale of their information or just a general access of information

07:18

that should, ideally, all be captured via email.

07:21

You might have to find yourself responding via email to get more information about the nature of the request.

07:27

Again, this is why choosing to use an email address is going to require a lot of micro management on your part.

07:32

It is therefore strongly recommended to avoid this methodology. If you're going to receive any more than five requests

07:42

that summarizes less than 8.3, and I will see you in the next lesson 8.4 as we go through the various consumer request channels that you can use if you are going to be receiving mawr than five requests a month,

07:54

this is high volume stuff

07:56

that's in the next lesson.

07:57

I recommend you tune in for that one.