>The controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject without undue delay and in any event within one month of receipt of the request[1]
The legal obligation may not have applied in this case, but it absolutely exists. If someone submits a request to you for their data, you are legally obligated to respond.
> I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.
First, the CCPA doesn't apply to my site. It's non-commercial, has many fewer users than required to invoke the CCPA, and zero revenue. No provisions of the CCPA require me to do anything.
Second, the questions were about how I'd handle a CCPA request, and weren't actually a request at all:
> 1. Would you process a CCPA data access request from me even though I am not a resident of California?
> 2. Do you process CCPA data access requests via email, a website, or telephone? If via a website, what is the URL I should go to?
> 3. What personal information do I have to submit for you to verify and process a CCPA data access request?
> 4. What information do you provide in response to a CCPA data access request?
The CCPA doesn't obligate anyone to explain their internal processes. It obligates covered entities to respond to the requests themselves, but not to random drive-by questions.
So basically, that sentence was completely wrong. The CCPA doesn't apply to me, and even if it did, the law doesn't say what the researchers claim it did.
Why isn't this the story? It doesn't even have to be about ethics which nobody can seem to agree on. Sounds like the researchers were simply wrong.
So then the problem actually is that they misinterpreted the law. If someone misinterpreting the law can cause such stress and waste such time, shouldn't society safeguard against this?
More like researchers needs to take classes on law jurisdictions. They seemingly to believes that both laws have jurisdictions over everyone in the world, including countries and states that don't have such laws which causes people to be confused with it since it have legal statement.
The researchers created this issue because they don't understand (or tried to understand) the laws nor they do not screen their statements. The liability is not on the law, the liability falls on the researcher especially with "human subject" comment. Therefore, the researchers are likely to be in violation with their university IRB. The legal statement is forcing people (that are not applicable to them) to respond which in turn violated the ethics of IRB because they did not consent to this research. By 'forcing' them to respond to the research that they don't have people consent to do so will run afoul with IRB.
