100 COMPANIES BUNGLE DATA ACCESS REQUESTS

California law grants residents the right to access personal data held by companies. In practice, exercising this right proves chaotic. Testers submitted formal data access requests to 100 businesses and encountered recurring problems: deletion notices instead of data disclosure, requests routed to wrong departments, and dead ends throughout the process. The findings highlight a gap between legal rights and operational reality. Companies often lack clear procedures for handling access requests, leading to inconsistent responses. Some firms appear to interpret requests as deletion orders rather than access demands. California's Consumer Privacy Act (CCPA) mandates companies provide collected data within 45 days of request. The law carries penalties for non-compliance, yet enforcement remains spotty. Residents attempting to exercise their rights face confusion that companies themselves seem to share. The testing reveals systemic failures in how businesses handle privacy compliance, suggesting regulators may need to establish clearer guidelines and enforcement mechanisms.