Americans are concerned about whether and how their personally identifiable information is being collected and retained by businesses and service providers. For example, a 2020 KPMG survey indicated U.S. consumers are increasingly concerned about how companies protect their personal data. An astonishing 97 percent said data privacy is important to them, and 56 percent indicated they wanted more control over such data.
The gap between sentiment and actual practice now is apparent, for the first time, by having data available showing what individuals might do if empowered by law to force companies to delete their personal data. That right is accorded to all California citizens under the California Consumer Privacy Act (CCPA), which took effect on January 1, 2020. Businesses covered by the CCPA are required to delete this personal information if requested by an individual when it no longer is needed by a business or otherwise can be kept under the law by a business for specific purposes.
Granted, the right of deletion is not absolute and must be initiated by individuals rather than companies. They must follow a two-step process that includes verification, and businesses can respond by presenting other options short of complete deletion as a way to keep some amount of personal information in an active database. These procedures may dissuade may from submitting a deletion request.
Some active participation by consumers, however, seems likely to always be part of any data deletion requirement enacted into law, whether on the state or federal level. But the initial deletion request data under the CCPA, which must be reported to the state, suggests that what people say and what they actually do is a larger issue that needs to be addressed.
There are over 32 million Californians who are online. Of these, during the first year that the CCPA was in force, Microsoft was the only company that received more than one million consumer data deletion requests (2.95 million). Apple received about 670,00 requests, Amazon about 101,000, and Facebook about 44,000. And Google? Only 516 requests.
Looking at this data both by company and collectively, it is readily apparent these figures are far below any that could be expected based on how intensely people say they feel about their personal information or their expressed desire to have more control over it. Does this mean that the law is not working as intended, that people say one thing and do another? Perhaps even both explanations make sense.
This is a critical area that deserves further research. It may suggest that the data deletion request process needs to be streamlined and contain fewer opportunities for companies to claim exemptions. Or it may suggest that the problem is one that exists more in theory than in practice.
Public policymakers at all levels of government should turn their attention to this concern, too. Any future legislation, including a possible federal law to be enacted in the 117th Congress, will require sufficient political capital of voters who believe that a data deletion mandate reflects their popular will and provides an effective mechanism in addressing a matter of clear public concern.
