Permitted Purposes for Sensitive Personal Information

What it requires

Subsection (m) lists the purposes for which a business may use or disclose sensitive personal information without offering a right to limit, among them providing the goods or services an average consumer would reasonably expect, security and fraud prevention, and physical safety. A business that confines its use to these purposes, reasonably necessary and proportionate to them, need not post the Notice of Right to Limit or provide a method to submit a request to limit. It is the scope test behind the § 7014 “Limit the Use of My Sensitive Personal Information” link.

Regulation text

(m) The purposes identified in Civil Code section 1798.121, subdivision (a), for which a business may use or disclose sensitive personal information without being required to offer consumers a right to limit are as follows. A business that only uses or discloses sensitive personal information for these purposes, provided that the use or disclosure is reasonably necessary and proportionate for those purposes, is not required to post a Notice of Right to Limit or provide a method for submitting a request to limit. (1) To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. [...]

California Consumer Privacy Act / California Privacy Rights Act, § 7027(m)Read the full section from California Privacy Protection Agency (CalPrivacy)