CivicPlus®’s Compliance with the CCPA
CivicPlus values its partnerships with those clients located in California and is committed to complying with the California Consumer Protection Act (CCPA). As such, CivicPlus does not sell any client or end-user data.
Compliance with Individual Data Requests
CivicPlus has established processes to respond to all CCPA requests from our clients. Please note, however, that since our clients, and not CivicPlus, are the Data Owners per the terms of the CCPA, we cannot respond directly to requests from our clients’ Data Subjects (citizen end-users).
Your Municipality’s Role in Responding to Data Subject Requests
To accommodate Data Subject requests in compliance with CCPA, we will direct all incoming Data Subject requests to the appropriate municipal representative. In these instances, the municipal Data Owner is responsible for determining whether or not to respond to a Data Subject’s CCPA-related request. As part of this determination process, we highly recommend that you discuss the following scenarios with your legal counsel:
- As a public entity, is your municipality required to comply with the request?
- Are there any applicable state or local laws that preempt or limit your ability to comply?
- Have you validated the identity of the requesting Data Subject?
How CivicPlus Will Support CCPA Data Requests
If a Data Owner elects to respond to a Data Subject request, CivicPlus will:
- Provide the Data Owner with all the data CivicPlus maintains on the Data Subject
- Delete all the data CivicPlus maintains on the Data Subject upon request
- Correct all the data CivicPlus maintains on the Data Subject upon request
To request one of the aforementioned actions, please email your request to the CivicPlus Privacy Team. You will receive an instructive response from the CivicPlus Privacy Team to which we ask that you reply within ten days with the following information:
- The product suite(s) of interest to the matter (CivicEngage®, CivicRec®, CivicClerk®, CivicHR®, CivicReady®, CivicOptimizeTM, CP ConnectTM, SeeClickFix);
- Your specific data request, including:
- The data subject’s name and email address
- Confirmation that you have verified the data subject’s identity
- If there are any affiliated entities whose data we should search (for instance, if you represent a county with a parks and recreation department whose data we should review, please explicitly state each affiliated entity)
- The specific action to be taken with the data:
- Access and provide comprehensive data related to the Data Subject
- Delete all data related to the Data Subject
- Correct any data related to the Data Subject
In most instances, CivicPlus will complete your CCPA-related request in 45 days. We will need up to 90 days to complete:
- Any compounded requests (e.g., a request to access data and a secondary request to delete the identified data)
- Any request related to CivicReady or CivicOptimize Productivity, as we must work with third-party service providers and partners to complete the request.
If you and your municipal administration elect to comply with CCPA requests, please know that you will also be responsible for submitting requests to all third-party service providers whose software integrates with your CivicPlus solution and within which the Data Subject’s information may reside. If you have questions as to whether a third-party software integrates with your solution, please contact your CivicPlus client success manager.