On the inventory of what you hold.
A startup CTO realizes how much personal data the company has collected, and how little of it she meant to.
CTO"We are a B2B company. We do not collect consumer data."/q:1
COUNSEL"Your customers are businesses. The people who log in are people. The CCPA cares about the latter."/q:2
CTO"Even at work?"
COUNSEL"Cal. Civ. Code § 1798.140(o). A natural person remains a natural person inside a corporate email address."/q:3
⁂
CTO"In the Symposium, Apollodorus is asked what Socrates said at a dinner he did not attend. He tells the story from a friend's account. What is the company, before I ask the database what it holds?"/q:4
COUNSEL"It is what its founders remember telling investors. Which, in our experience, is half of what the database will say when you ask it directly."/q:5
CTO"I just asked it directly."
COUNSEL"And the number was larger than the founders' account. That is the answer to your question about what the company is."/q:6
⁂
CTO"What must I do?"
COUNSEL"First, a data map. Second, a retention schedule. Third, an honest privacy policy. The order is not optional."/q:7
CTO"Why that order?"
COUNSEL"Because the policy describes what you do. You cannot describe what you do not yet know. And you cannot promise to delete what you cannot find."/q:8
⁂
CTO"And the IP addresses we kept in logs for two years 'in case'?"
COUNSEL"Personal information under § 1798.140(v)(1)(A). Delete what you do not need. Document what you keep. The audit will not ask why you collected. It will ask why you still have it."/q:9
CTO"And if a consumer asks me to delete their account tomorrow?"
COUNSEL"Forty-five days under § 1798.130. Plus the data in your warehouse, your CRM, your support tool, your analytics, and the spreadsheet your sales lead exported in March."/q:10
⁂
CTO"That is more places than I knew about."
COUNSEL"It always is. The map is built by asking each team what they exported and to where. That conversation, run once a quarter, is the whole privacy program of nine out of ten companies that survive an audit."/q:11
⁂
Coda. The data map took eleven days. Retention was set at twenty-four months for logs and indefinite for nothing. Two warehouse tables were dropped entirely. The privacy policy shrank by a paragraph and gained a sentence that was, for the first time, true.
— D. A., this 21st of June, MMXXVI.