Right to access information: individuals have the right to know, and companies must provide access to, the categories of personal information that are collected and sold, how their information was obtained, with whom their information was shared, why their information was collected, and what specific pieces of information were collected (with some exclusions).