Privacy Policy

We collect personal information only through lawful means and in a variety of ways: 

Interaction with the Agency.  We may collect the personal information identified below when you interact with the Agency in the following ways.   

Submission of a Complaint:  When you submit a complaint through our complaint form, you may provide us with name, email address, phone number, address, and other personal information (e.g., employment history, financial information, internet activity) related to your complaint.  The complaint form also uses technologies to reduce misuse and unwanted processing, such as spam, phishing, or bot activity.
Attending Board Meetings.  When you attend Board meetings in person, you may provide your name and email address.  When you attend via Zoom, you may reveal some information, such as your name, IP address, email address, and phone number.   
Emails or PRA Requests to the Agency:  When you email the Agency or make a request under the Public Records Act, you may provide us with your name, address, email address, and the contents of your email. 
Public Comments during Rulemaking or Board Meetings.  When you speak or comment during the Agency’s rulemaking activities or during Board meetings, you may provide your name, contact information (e.g., email address, phone number, mailing address), and other personal information in the contents of the comment.
Other Rulemaking Activities:  You may provide us with your name, email address, and other information when participating in the Agency’s pre-rulemaking activities. We automatically collect information about your visits to our website to help run and improve our services, and for data security purposes.  

Some of the information we automatically collect and store are: 

A partial Internet Protocol address and domain name is collected. 
The type of browser and operating system you used.
The city and zip code you used it from.
The date and time you visited this website.
The webpages or services you accessed at this website.
The website you visited prior to coming to this website.
The website you visit as you leave this website.
If you downloaded a form, the form that was downloaded.
This information is used to improve the content of our web services and to help us understand how people are using our services. We take steps to limit how this information can be used by our service providers.   

Investigations. We may collect personal information through investigations of potential or alleged violations of the CCPA.  

Use of your personal information
The personal information we obtain will be used for the purposes for which it was provided and in accordance with the duties required of the Agency under the CCPA (see Civ. Code § 1798.199.40).  For example, this includes:

Processing and investigating consumer complaints of potential violations of the CCPA and enforcing the CCPA through administrative actions. Facilitating the public’s participation in the Agency’s rulemaking activities, such as by maintaining an email listserv to inform the public of rulemaking activities and obtaining public comment on potential regulations as required by the Administrative Procedure Act. 
Promoting awareness and understanding of the CCPA and providing guidance to consumers of their rights and businesses of their obligations. Cooperating with other agencies and other authorities with jurisdiction to enforce privacy laws and ensure consistent application of privacy protections. Monitoring basic website statistics, such as unique visitors per day. Ensuring the safety and security of our website. Disclosure and sharing of personal information We do not sell your personal information. Government Code § 11015.5(a)(6) prohibits all state agencies from distributing or selling any electronically collected personal information about users to any third party without the permission of the user. 
We may, however, disclose or share your personal information in limited circumstances, such as when: 

You give us permission (including through your submission of a sworn complaint). We receive a request from a party with legal authority to obtain the information, such as a subpoena, court order, or government order. We transfer or share your complaint or public comment with another California agency, state, local, federal, or foreign government, as appropriate. We disclose personal information in connection with rulemaking activities or facilitating public Board meetings, such as when coordinating public hearings or submitting materials to the Office of Administrative Law. We are complying with a valid California Public Records Act request. See “Public Disclosures” section below for more information about the Public Records Act. The Agency is supported by other state agencies, including the Department of Consumer Affairs and the Department of Technology, which provide IT services and support for our websites. These Departments adhere to their own privacy policies.  

Public disclosures:
Your personal information may be part of a public record that could be subject to a Public Records Act request.  The California Public Records Act (PRA), Gov. Code §§ 7920 et seq., gives the public the right to inspect government records upon request, with some exemptions.  For example, the Agency is exempt from disclosing portions of public records that contain personnel, medical, or similar files for Agency employees, and records pertaining to pending litigation.  Electronically collected personal information is also exempt from disclosure in response to PRA requests, as well as enforcement-related investigative files that may contain personal information. The exemptions are listed in Government Code §§ 7930.100, et seq. 

In response to a PRA request, we will redact personal information if an exemption applies, or if required to do so by other laws.  Find out more information about how we handle PRA requests.

In the event of a conflict between this privacy notice and the Public Records Act, the Information Practices Act and/or other law governing the disclosure of records, the Public Records Act, the Information Practices Act and/or other applicable law will control.