{"slug":"us-california-ccpa-admt-access","id":"AIPT-OBL-0120","permanent_url":"https://aipolicytracker.org/id/AIPT-OBL-0120","title":"Answer consumers' requests to access information about how automated decision-making technology was used about them","short_title":"Access to ADMT information","category":"transparency","summary":"On a verified request, the business must explain in plain language the specific purpose for which it used ADMT about the consumer; the logic of the ADMT, enough for the consumer to understand how their information produced the output; the outcome and how the output was used in the decision, including any human's role; and that retaliation is prohibited, with how to exercise other CCPA rights. Trade secrets and certain security information may be withheld. Where ADMT was used about the consumer more than four times in 12 months, an aggregate-level response is allowed. Service providers and contractors must help.\n","practical_action":"Prepare a response template per system covering purpose, logic, outcome and human role, route access requests through the existing request-to-know process, and require vendors by contract to supply what the response needs.","is_binding":true,"applies_from":"2027-01-01","section":"Article 11, § 7222","source_reference":"Cal. Code Regs. tit. 11, § 7222","official_source_url":"https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf","review_status":"pending_review","confidence_level":"high","last_verified_at":null,"reviewed_by":null,"actors":["deployer"],"sectors":["employment","financial_services","healthcare","education"],"use_cases":["hiring_and_hr","health","finance_and_credit","education"],"applicability":[],"evidence_examples":[{"title":"An access-response template per system and a log of requests answered","description":null,"artifact_type":"document"},{"title":"Contract terms requiring vendors to assist with access requests","description":null,"artifact_type":"document"}],"framework_mappings":[],"controls":[{"slug":"decision-explanation-and-appeal-route","title":"Decision explanation, human review and appeal route","kind":"process","relationship":"satisfies","note":"Explaining the purpose, logic and outcome of the decision to the person.","confidence_level":"high","url":"https://aipolicytracker.org/controls/decision-explanation-and-appeal-route"},{"slug":"contractual-allocation-of-ai-duties","title":"Contractual allocation of AI duties across the supply chain","kind":"contractual","relationship":"supports","note":"Vendors must assist with access requests.","confidence_level":"medium","url":"https://aipolicytracker.org/controls/contractual-allocation-of-ai-duties"}],"url":"https://aipolicytracker.org/obligations/us-california-ccpa-admt-access","policy":{"slug":"us-california-cppa-admt-regulations","title":"California Privacy Protection Agency regulations on automated decision-making technology, risk assessments and cybersecurity audits","status":"in_force","jurisdiction":"us-california","url":"https://aipolicytracker.org/policies/us-california-cppa-admt-regulations"}}