Comments on the final California Consumer Privacy Act (CCPA) regulations asked if data brokers should be required to identify the factors they use in algorithmic decision making practices that affect the consumer, such as consumer scores?

The California Attorney General responded:

• Inferences derived from personal information to create a profile about a consumer are personal information under CCPA.
• If a data broker collects this type of personal information – they would need to disclose it in a response to a verifiable access request.
• Per the CCPA regs, information provided under CCPA – this needs to be provided in a manner that provides consumers a meaningful understanding of the information being collected.

Not quite the limitation on automated processing in Article 22 of the European Union’s General Data Protection Regulation (GDPR), but close to the Article 13 GDPR requirement about disclosing automated decision making and profiling and providing “meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.”

Closer still if profiling is tied with a financial incentive program with respect to which CCPA requires additional detail.