Page 10 Summer 2019 Points of Interest §1798.145(g)(3). Unfortunately,thestatute hasleftittobusinessesandtheirattorneys to outline the contours of this exception. And the Act provides that a business has theburdenofdemonstratingthatarequest is manifestly unfounded or excessive. The Act makes clear that a consumer is permittedtomakerequestsforinformation from businesses no more than twice in a 12-month period. See, e.g., Cal. Civ. Code § 1798.100(g). Presumably, if a single consumer makes more than two verifiable consumerrequestsinany12-monthperiod, thebusinesswouldbejustifiedindeeming those requests to be excessive. However, there is no guidance for determining whether a request is “manifestly unfounded.” Certainly, if a consumer sought information that a businessdoesnothaveabouttheconsumer (forexample,ifthebusinessdidnotsellany personal information of that consumer, but the consumer requested information about what information the business sold about the consumer), the request may be deemed “unfounded” (though it is doubtful that the business could charge the consumer a fee for responding to such a request). However, beyond this obvious situation, the Act provides no guidance, and absent clarification, businesses must developtheirowncriteria–consistentwith the letter and spirit of the Act – for making that determination. What “Appellate Rights”? If a business does not take any action regarding a verifiable consumer request, either because the business determines that the request is manifestly unfounded or excessive, as discussed above, or because the business does not have the information that the consumer requests, theActrequiresthebusinesstoinformthe consumer “without delay” of the reasons that the business is not taking action, along with a description of “any rights the consumermayhavetoappealthedecision of the business.” However, the CCPA nowhere provides any rights of consumers to “appeal” a business’ decision not to respond to a verifiable consumer request. Accordingly, it is not clear what appellate rights to which this language in the CCPA may be referring. Obviously, if the business provides, as part of its own internal procedures for compliance with the Act, a right to appeal the business’s decision not to respond to a request, those rights would qualify and must be disclosed. However, absent such aninternalprocedure,itwouldappearthat a business need not provide a consumer any right to appeal the business’s decision regarding a verifiable consumer request, and it is not clear why this language appears in the Act or how businesses should interpret it. Consumer Privacy Act – continued from page 9 continued on page 11