This California Consumer Privacy Act Disclosure ("Disclosure") explains how Discover Bank, DFS Services LLC, PULSE Network LLC, Diners Club International, Ltd., the Discover Global Network, Pulse EFT Association, Inc., DFS Corporate Services LLC, DFS International Incorporated, Discover Products Inc., the Student Loan Corporation and their affiliates and subsidiaries (collectively, "Discover", "we", or "us") collect, use, and disclose Personal Information relating to California residents that is subject to the California Consumer Privacy Act ("CCPA"). Discover affiliates and subsidiaries include companies related by common ownership or control with a Discover or DFS name and financial companies such as GTC Insurance Agency, Inc.
What is Personal Information?
Under the CCPA, "Personal Information" is information that identifies, relates to, or could reasonably be linked with a particular California resident or household. The CCPA, however, does not apply to certain information, such as information subject to the Gramm-Leach-Bliley Act ("GLBA").
As a result, this Disclosure does not apply, for example, with respect to information that we collect about California residents who apply for or obtain our financial products and services for personal, family, or household purposes ("GLBA Consumers").
Additionally, any personal information provided to or received by us related to a business or commercial product or service, including any information collected and used to conduct due diligence, is not subject to this Disclosure.
In the past 12 months, we have not "sold" Personal Information relating to California residents within the meaning of the CCPA. For purposes of this Disclosure, "sold" means the disclosure of Personal Information to a business or third party for monetary or other valuable consideration.
Our Collection, Use, and Disclosure of Personal Information
We collect Personal Information relating to California residents in a variety of contexts as described below. For example, we collect Personal Information relating to California residents for marketing purposes and from individuals who apply for employment with us or are our employees, vendors, contractors, or similar personnel. The specific Personal Information that we collect, use, and disclose relating to a California resident will depend on our specific relationship or interaction with that individual. In the past 12 months, we have: (1) collected the following categories of Personal Information relating to California residents; and (2) shared or disclosed the following categories of Personal Information relating to California residents to vendors or other counterparties for our business purposes:
(1) Personal Identifiers, such as name and mail address;
(2) Personal information, as defined in the California safeguards law, such as contact information and financial information;
(3) Characteristics of protected classifications under California or federal law, such as age, citizenship, and marital status;
(4) Commercial information, such as transaction and account information;
(5) Internet or electronic network activity information, such as browsing history and interactions with our website;
(6) Geolocation data, such as device location and certain device information;
(7) Sensory data, including audio, electronic, visual, and similar information such as call recordings;
(8) Professional or employment-related information, such as current employment information or employment history;
(9) Education information, such as school and date of graduation; and
(10) Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual's preferences and characteristics.
The purposes for which we use the Personal Information that we collect depend on our relationship or interaction with a specific California resident. Nonetheless, we may use Personal Information we collect to operate, manage, and maintain our business, to provide our products and services, for our employment and vendor management purposes, and to accomplish our business purposes and objectives. For example, we use Personal Information we collect to:
(1) Detect security incidents;
(2) Personalize, develop, market, advertise, and provide our products and services (including analytic services);
(3) Provide customer service;
(4) Process payments or transactions, provide financing, or fulfill orders;
(5) Conduct research and data analysis;
(6) Detect and prevent fraud (including protecting against and/or prosecuting malicious, deceptive, fraudulent, or illegal activity);
(7) Perform identity verification;
(8) Maintain our systems, infrastructure, and facilities including debugging to identify and repair errors that impair existing intended functionality;
(9) Maintain or service accounts;
(10) Conduct risk and security control and monitoring;
(11) Perform accounting;
(12) Perform audit functions, including auditing interactions with consumers;
(13) Maintain and enhance a product or service;
(14) Verify and provide employment benefits and administration (e.g., employment eligibility, payroll, and performance management); and
(15) Conduct other internal functions, such as investigations or research for technology development, comply with legal obligations, maintain business records, and exercise and defend legal claims and rights.
We collected the categories of personal information set forth above from the following categories of sources:
A. Directly from you;
B. Through Discover affiliates and subsidiaries;
C. Through non-affiliated business partners or other counterparties;and
D. CCPA Service Providers, with whom we have a contractual relationship to perform services on our behalf;
We may share or disclose personal information for a business purpose to the following categories of third-parties:
A. Discover affiliates and subsidiaries;
B. Non-affiliated business partners or other counterparties;
C. CCPA Service Providers,with whom we have a contractual relationship to perform services on our behalf; and
D. Regulatory agencies and law enforcement.
Your Rights Under the CCPA
If you are a California resident, you may request that we disclose to you the following information covering the 12 months preceding your request:
(1) The categories of Personal Information that we collected about you and the categories of sources from which we collected such Information
(2) The business or commercial purposes for collecting Personal Information about you;
(3) The categories of Personal Information about you that we disclosed for a business purpose and the categories of third parties to whom we disclosed such Personal Information (if applicable); and
(4) The specific pieces of Personal Information we collected about you.
If you are a California resident, you may also request that we delete Personal Information that we collected from you. The CCPA sets forth exceptions for when information is not required to be deleted, including but not limited to where information is necessary to maintain in order to provide a good or service that you requested, comply with a legal obligation, detect security incidents or protect against malicious, deceptive, fraudulent, or illegal activity.
Further, in some instances, we may decline to honor your request where an exception applies, such as where the disclosure of Personal Information would adversely affect the rights and freedoms of another consumer, where the Personal Information that we maintain about you is not subject to CCPA requirements, or where the Personal Information is a trade secret.
Nonetheless, you have the right to be free from unlawful discrimination for exercising your rights under the CCPA.
Changes to This California Consumer Privacy Act Disclosure
We may change or update this Disclosure from time to time. When we do, we will post the revised Disclosure on this page.