CCPA INFORMATION

PURPOSE

The California Consumer Privacy Act (CCPA) was passed in 2018. The CCPA provides for many consumer privacy rights. It imposes many responsibilities on entities that collect and use personal data.

SCOPE

This policy applies to Data Subjects, whose personal information is collected and maintained by the District. More generally, the CCPA applies to any entity that collects or provides the personal information of California residents and meets one or more of the following criteria:

• Has $25 million or more in annual sales.
• Buys, sells, or shares information on 50,000 or more individuals, households, or devices.
• Derives more than half of its annual revenue from selling personal information

RESPONSIBILITIES

The Chief Privacy Officer is the privacy official for the Santa Rosa Junior College District, and ensures that the requirements in these policies are maintained in accordance.

All workforce members including employees, contracted staff, students and volunteers are responsible for ensuring that individuals comply with this policy. Violations of this policy will be reported to the SRJC Privacy Office. Reported violations will be investigated by the SRJC Privacy Office in collaboration with appropriate departments, such as the Office of General Counsel, Global Business Services or the Information Security Office. Workforce members who violate this policy may be subject to the appropriate disciplinary action up to and including termination.

DATA SUBJECTS RIGHTS

Individuals located in California only, whose Personal Data SRJC processes (“Data Subjects”), have the following rights with regard to their Personal Data:

“Personal Information” is any information that we can reasonably use to identify you.

The District will inform any third parties with whom it might have shared the Data Subject’s Personal Information of the deletion request.

The District may decline a Data Subject’s request for deletion if processing of their Personal Information is necessary.

Rights enumerated:

1. Right to be notified about information collected and the purpose of use
   
   The District must inform consumers at or before the point of collection what categories of personal information will be collected and the purposes for which these categories will be used.
    
2. Right of Data Subjects to request and receive disclosures about their personal information within the past 12 months
    
3. Right to data portability
   
   Data Subjects have the right to access their personal data in a readily useable format that allows the consumer to transmit information from one entity to another entity without hindrance.
    
4. Right to Request Deletion
   
   This policy is subject to other regulatory and Educational Code limitations
    
5. Right to opt out of the sale of personal information to third parties
   
   Note - The District does not sell personal data to Third Parties

Response from the District

Any person, Department or School at the District that receives a request from a Data Subject seeking to exercise their rights under CCPA should contact the District Privacy Officer to assist in the review of and response to the Data Subject’s request. Requests will be responded to within 30 days of receipt. Under certain circumstances, the District may inform the requesting Data Subject that additional time is needed to fully comply with the request. Such notification shall occur within 30 days of receipt of the request.

What must the District disclose if a Data Subject makes a verified request?

The District must disclose:

• Categories of personal information collected
• Sources from which information was collected
• Purposes for which the information was collected
• Categories of third parties with whom the information is shared