For all types of requests, respond free of charge and always comply to the extent possible. If there’s a reason you cannot comply, explain it and also explain your appeal procedures if you offer a right to appeal.
For right to know requests, consumers can request either a copy of the specific pieces of data you collected, or information about your sources and uses of that data by category. For both request types, respond based on your last 12 months of activity from the date you received the request.
If a consumer requests information about data use by category, you need to provide (1) the categories of data collected, such as contact information or purchase history, (2) the cate gories of sources it was collected from, for example from ad networks or the consumer’s web browser, (3) the business purposes for which you collected each category, for example order fulfillment or marketing, (4) the categories of third parties you sold or disclosed each category of data to, for example IT infrastructure partners or marketing agents and (5) the business purposes for which you disclosed or sold the data, for example order fulfillment and marketing. Individualize these responses unless your responses would be the same for all consumers.
If a consumer requests a copy of the specific pieces of data you collected, never include government identification or financial account numbers, passwords, biometric data or other highly sensitive information and instead inform consumers about which of these items you’ve collected. You can also omit any information that isn’t easily accessible if you maintain it exclusively for legal or compliance purposes and you inform that the consumer about the categories of records that meet those criteria. Use reasonable security when transmitting information to consumers. If a consumer has an account with you, you must provide their information via the account, and otherwise need to give the consumer a choice between receiving their information via postal mail or electronic delivery.