CCPA Practice Tip Series

PDF

Professionals

Practice Areas

Adam A. Berkland, Charles H. Bowyer and Allen T. O'Rourke
Robinson Bradshaw Publication

The California Consumer Privacy Act of 2018 (CCPA) went into effect on Jan. 1, 2020, creating an array of new obligations and legal risk regarding the personal information of California consumers for businesses covered by the law. Complying with the CCPA can be challenging, but Robinson Bradshaw attorneys are here to help. We are providing a series of CCPA Practice Tips to help businesses understand the new requirements and implement compliance strategies. Drawing on our experience helping clients to prepare for the CCPA, we will break down the challenge of compliance into small, digestible pieces and address key practical issues facing businesses. Of course, every business covered by the law will need a compliance strategy tailored to its unique circumstances. If you have questions about any of the information provided here or about how the CCPA may apply to your business, please do not hesitate to contact any member of our Cybersecurity and Privacy Practice Group for assistance.

Please note that our CCPA Practice Tips take into account not only the text of the CCPA as amended but also the proposed implementing regulations submitted by the California attorney general (as first revised in February 2020 and further revised in March 2020) and other guidance that may become available by the time of publication. As the text of the proposed regulations could change again before they become finalized, we plan to update our guidance here as needed to reflect such changes (if any). Please contact us for the most up-to-date information.

Tip #1: Step-by-Step Approach to Compliance

Originally published Jan. 2. Updated Feb. 27.

As the CCPA has now gone into effect, businesses will have about six months before July 1, 2020, when the California attorney general can begin enforcing the CCPA. It could be even longer before the CCPA's implementing regulations are finalized. However, consumers covered by the law can now begin submitting certain types of legal requests to businesses handling their personal information. Businesses also can face litigation under the CCPA's limited private right of action for data breaches of certain personal information.

This first Practice Tip of our series provides an overview of what the CCPA requires from most businesses covered by the law and then outlines a general step-by-step approach to compliance. In future Practice Tips, we will address the applicability of the CCPA, including what types of business are covered and how key terms are defined, and examine important aspects of compliance in greater detail.

Overview of CCPA Obligations

Generally, for most businesses covered by the CCPA, there are four basic requirements that must be addressed from the outset to comply. The business has to do the following:

  1. Provide additional disclosures to consumers, including notifying consumers in ways that go beyond what has been traditionally covered by a privacy policy.
  2. Honor consumers' rights to request specific information about what personal information the business collects, uses, discloses and sells about that consumer (a "request to know") and to request the deletion of that consumer's personal information collected by the business (a "request to delete").
  3. Update contracts with service providers and other businesses with which the business shares personal information.
  4. Adopt commercially reasonable data security measures to protect personal information from unauthorized access, theft or disclosure.

Notably, there are additional obligations for a business that:

These situations trigger special requirements under the CCPA that are beyond the scope of this Practice Tip. Please contact us for more information if you have questions about compliance in such situations.

Finally, the CCPA's obligations do not currently extend to the personal information of a business's own employees or job applicants or to the personal information of the individual employees or other personnel of business entity clients, customers, service providers or partners/collaborators (e.g., B2B services). The CCPA's obligations around treatment of personal information from these types of individuals have been suspended until Jan. 1, 2021.

Step-by-Step Approach to Compliance

Each business is unique and will need a compliance strategy tailored to its needs. However, we have developed the step-by-step approach outlined below through our experience helping companies prepare for the CCPA. These basic steps provide a helpful framework and starting point for businesses working to comply with the CCPA.

In future installments of our CCPA Practice Tip Series, we will focus on specific steps for compliance in greater detail. Before we do that, however, our next Practice Tip will address the scope of the CCPA and what businesses are covered by the law. If you have questions about any of the information provided here or about how the CCPA may apply to your business, please feel free to contact any member of our Cybersecurity and Privacy Practice Group or any other Robinson Bradshaw attorney with whom you are working.

Tip #2: Which Businesses Must Comply

Originally published Jan. 9. Updated Feb. 27.

This second Practice Tip of our series explores the threshold issue of who must comply with the CCPA that has now gone into effect. In general, the obligations apply only to "businesses" collecting consumers' personal information. The CCPA's concept of a "business" generally means:

– Has annual gross revenues in excess of $25 million;
– Annually buys, receives, sells or shares the personal information of 50,000 or more consumers, households or devices; or
– Derives 50% or more of its annual revenues from selling consumers' personal information.

"Business" also includes any entity that is an affiliate of and shares common branding with an entity meeting the above definition. This likely covers any affiliate with a shared name, service mark or trademark.

Doing Business in California

The CCPA's phrase "does business in the State of California" is not defined any further in the statute. However, based on prior legislation, it is clear that a physical operation in California is not required. Also, given how the statute includes an exception for situations where every aspect of the collection and use of consumers' personal information takes place wholly outside of California, the drafters of the CCPA clearly believed that businesses domiciled outside of California may be subject to the law. Thus, lots of businesses located throughout the United States, especially those with an online presence, will likely be regarded as "doing business" in California for purposes of the CCPA.

Collects Personal Information of Consumers

Here "consumer" means any individual California resident. Of course, this is much broader than how the word is typically used. For example, a company's own personnel and job applicants as well as the employees and other individual representatives of its business clients (e.g., when engaging in business-to-business transactions) are technically "consumers" under the CCPA so long as they are California residents. However, because of an amendment regarding this issue, the effective date of the CCPA has been delayed to Jan. 1, 2021, regarding these types of individuals.

Personal InformationAlso bear in mind that the CCPA applies both when a business collects personal information on its own and also when the business directs a third-party service provider to collect the information on behalf of the business. Indeed, when service providers are involved, the CCPA includes requirements for what to include in the service agreement.

Determines the Purposes and Means of Processing Personal Information

The CCPA only directly places obligations on a business that "alone, or jointly with others, determines the purposes and means of the processing" of consumers' personal information. Generally, this occurs when the business has a direct relationship with the consumer – that is, they are "your" customer or client – or in other situations where the business is able to dictate and control how the personal information is used. In contrast, service providers that collect, store or otherwise process personal information on behalf of a business client or customer as directed are generally only obligated to comply with certain elements of the CCPA.

The Extent of the Business, Personal Information and Revenue

Finally, the business must also either (i) have annual gross revenues in excess of $25 million, (ii) annually buy, receive, sell or share the personal information of 50,000 or more consumers, households or devices or (iii) derive 50% or more of its annual revenue from selling (as defined in the CCPA) consumers' personal information. As to the first threshold, there is some debate over whether the $25 million revenue threshold is revenue globally, nationally or in the state of California. Until more guidance is provided, it is safest to assume global revenue should be considered. Additionally, due to the broad definition of "consumer" discussed above, many more businesses will meet the second threshold than a first glance would suggest.

Some Exceptions

Even if you operate a "business" covered by the CCPA, the law's requirements would not apply to your processing of certain types of personal information, including the following:

– Health information covered under the California Confidentiality of Medical Information Act (CMIA) and the Health Insurance Portability and Accountability Act (HIPAA);
– Information collected in a clinical trial subject to the Federal Policy for the Protection of Human Subjects (the Common Rule);
– Personal information transferred to or from a consumer reporting agency if such information is already protected by the Fair Credit Reporting Act (FCRA);
– Consumer financial information protected by the Gramm-Leach-Bliley Act (GLBA) or the California Financial Information Privacy Act (FIPA); and
– Personal information covered by the federal Driver’s Privacy Protection Act.

Tip #3: Scope of "Personal Information" and "Sales"

Originally published Jan. 16. Updated Feb. 27.

After determining that the CCPA applies, a business will need to carefully assess so-called "data flows" of personal information in order to develop a compliance strategy. To this end, here are some key questions to be answered:

The answers to these questions will go a long way to defining the scope of a business's obligations under the CCPA. For example, the CCPA imposes stricter requirements on businesses that "sell" personal information, collect the personal information of persons under the age of 16, or treat consumers differently based on their agreeing to the collection or sale of personal information or their other exercise of CCPA rights. Accordingly, for this third Practice Tip, we focus on what counts as "personal information" and "selling" such information for purposes of the CCPA.

Personal Information

"Personal information" is broadly defined in the CCPA. It means "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."

HouseholdsBeyond this general definition, the CCPA provides a list of examples of items that would be personal information if reasonably linked or linkable with a particular consumer or household:

As these examples make clear, the CCPA's concept of personal information goes far beyond the typical categories of personally identifiable information found in U.S. privacy laws. Thus, you must think expansively in the assessment of data flows within your business to identify all personal information that may be covered by the CCPA.

The CCPA does specify a number of exceptions which provide some limits to the scope of personal information subject to the law. For example, "deidentified" personal information, "aggregate consumer information," and 'publicly available information" (i.e., available from federal, state or local government records) are specifically excluded. Furthermore, as mentioned in our earlier Practice Tip concerning the scope of the CCPA, certain types of personal information already governed by industry-specific federal or California laws are also carved out of the statute. Finally, two key areas of personal information have been carved out of the CCPA until Jan. 1, 2021. These are, broadly speaking, a company's own personnel and job applicants as well as the employees and other individual representatives of its business clients, such as when engaging in business-to-business transactions.

Sales of Personal Information

A business that "sells" personal information faces additional requirements under the CCPA, including more disclosure obligations and the requirement to have a mechanism for consumers to opt out of the sale of their personal information. Accordingly, after figuring out the data flows of personal information, businesses must also determine whether any of their disclosures of personal information would be considered a "sale" for CCPA purposes.

"Sell," "selling" and the like basically mean a business's disclosure of personal information to a third party for anything of value. Specifically, the term is defined very broadly to mean "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration."

As with the concept of personal information, this definition of selling goes well beyond what the term typically means. In particular, "other valuable consideration" could mean a wide range of things, such as getting access to another's marketing list or learning additional consumer insights to help with marketing. Thus, in assessing whether a disclosure of personal information to a third party could amount to "selling" under the CCPA, it is important to consider the whole relationship with the third party and how the business may benefit from the disclosure.

The CCPA does specify a number of exceptions, however. The following transfers of personal information are not considered "sales" under the CCPA:

Tip #4: Notices Required by the CCPA

Originally published Jan. 24. Updated April 2.

Businesses covered by the CCPA must provide certain specific notices to consumers. The business's privacy policy must be updated to include detailed information that goes beyond what a business would ordinarily cover in its privacy policy, and the CCPA further requires businesses to provide new forms of notices to consumers. This installment of our CCPA Practice Tip Series describes the notices required under the CCPA. Bear in mind that this Practice Tip draws heavily from the California attorney general's proposed implementing regulations for the CCPA, and therefore may be subject to change when the implementing regulations are eventually finalized.

Notice in the Privacy Policy

Under the CCPA and proposed implementing regulations, businesses will need to update their posted privacy policies to ensure that the policies inform consumers about all of the following:

Purposes

Additionally, if the business annually buys, sells or shares the personal information of at least 10 million California consumers, the business must make additional disclosures to consumers in its privacy policy.

Notice at Collection

In addition to the disclosures in privacy policies, the CCPA also requires businesses to provide notice to a consumer at or before the time a business collects personal information from that consumer. This new, separate type of notice is referred to in the CCPA as "Notice at Collection." This notice must contain:

If the business collects personal information online, then it may provide the Notice at Collection by giving consumers links to the sections of the privacy policy with the relevant details at or before the time of collecting the personal information. Two possible methods for displaying such a Notice at Collection online could be a pop-up box that displays before the consumer submits any personal information or a brief disclaimer that appears immediately before the "Submit" button on a web form. Businesses that primarily collect personal information offline (e.g., a brick-and-mortar retailer) must find direct ways to provide this Notice at Collection, such as written handouts or signage.

"Do Not Sell" Notice

If the business sells the personal information of consumers to third parties – that is, in the broad meaning of "sell" under the CCPA – then it must also provide a Notice of Right to Opt-Out of Sale of Personal Information. This notice must inform consumers about:

This notice must be accessible by a clear and conspicuous link entitled "Do Not Sell My Info" or "Do Not Sell My Personal Information" on the business's website or mobile application, but the required information may be provided by including a link to the sections of the business's privacy policy that addresses these topics. However, a business that substantially interacts with consumers offline must also provide this notice by an offline method, such as written handouts or signage directing consumers to where this notice may be found.

On the other hand, if the business does not sell the personal information of consumers, then it must include a statement in its privacy policy to this effect. In this situation, the business would not have to provide the "Do Not Sell" notice described here.

Notice of Financial Incentive

Finally if the business offers financial incentives to consumers in exchange for the collection of or permission to sell their personal information, or if the business offers different pricing or quality of goods or services to consumers as a result of their sharing of or permission to sell their personal information, then the business must also provide a Notice of Financial Incentive to the consumer. This notice describes the financial incentive or price or service difference that is provided to consumers based on their decision to share or allow the sale of personal information, as detailed in the CCPA regulations.

Form of the Notices

Generally, the proposed CCPA regulations would require that each type of notice:

In addition, the business's privacy policy must:

If you have questions about any of the information provided here or you need a legal review of your privacy policy or other consumer notices under the CCPA, please do not hesitate to contact any member of our Cybersecurity and Privacy Practice Group for assistance.

Tip #5: Submission of Consumer Requests

Originally published Jan. 31. Updated April 2.

The CCPA gives consumers (a) the right to request specific information about what personal information a business collects, uses, discloses and sells about that consumer (a "request to know"); (b) the right to request the deletion of that consumer's personal information collected by the business (a "request to delete"); and (c) the right to opt-out of the sale of that personal information by the business (a "request to opt-out"). 

To ensure that consumers can easily exercise these rights, the CCPA and proposed regulations require businesses to make available to consumers certain specified methods for submitting requests, and to train their employees on handling such requests. Furthermore, upon receiving one of these consumer requests, the business must take steps to verify the identity of the individual making the request – so as to prevent unauthorized access to or deletion of the consumer's personal information – and then either comply with the request or, if an exception or valid reason to deny the request applies, explain this exception or denial in a written response to the consumer. The business must also maintain records of how it has processed such consumer requests under the CCPA.

This Practice Tip will focus on the specific methods a business must make available for consumers to submit requests to know, requests to delete and requests to opt-out according to the proposed regulations. In future Practice Tips, we will address the remaining requirements in greater detail.

Methods for Consumers to Submit Requests to Know and Requests to Delete

With respect to consumers' requests to know: A business that operates exclusively online and has a direct relationship with a consumer from whom it collects personal information is only required to provide an email address to allow consumers to submit requests to know (though it can certainly offer additional methods if it so chooses). All other businesses must provide at least two designated methods to allow consumers to submit requests to know, including, at a minimum, a toll-free telephone number. Other examples of acceptable methods include (but are not limited to) a form submitted in person or a form submitted through the mail.

With respect to consumers' requests to delete: All businesses (including businesses that operate exclusively online) must provide at least two designated methods to allow consumers to submit requests to delete. Examples of acceptable methods include (but are not limited to) a toll-free telephone number, a link or form available online through a business's website, a designated email address, a form submitted in person or a form submitted through the mail.

Businesses must consider the methods by which they primarily interact with consumers when determining which methods to provide for consumers to submit requests to know and requests to delete. For example, if the business primarily interacts with consumers in person, the business must consider providing an in-person method to submit requests to know and requests to delete, such as through a printed form the consumer can submit through the mail, by providing an on-site tablet or computer portal that allows the consumer to complete and submit an online form, or by providing a telephone by which the consumer can call the business's toll-free telephone number for submitting such requests.

If the consumer has a password-protected account through the business's website, mobile app or similar online service, the business can enable consumers to submit requests to know and requests to delete through a secure, self-service portal on the business's website, mobile app or other online service after the consumer has logged in to their account. This method has many advantages for reasons that will be described in future Practice Tips.

A request to delete that is processed online may be implemented using a two-step confirmation process where the consumer must first, clearly submit the request to delete and then second, separately confirm that he or she wants the personal information deleted. Additionally, the business may present the consumer with a choice to delete select portions of his or her personal information, but only if the business also offers the consumer a global option to delete all of the consumer's personal information (and the global option must be more prominently presented).

In the event that a consumer submits a request to know or request to delete in a manner that is not one of the business's designated methods, the business has two choices. It can treat the request as if it had been submitted in accordance with one of the business's designated methods, or it can provide the consumer with instructions on how to properly submit the request through one of the business's designated methods.

Methods for Consumers to Submit Requests to Opt-Out

If a business sells consumers' personal information within the meaning of the CCPA, it must additionally make available to consumers certain specified methods for the consumer to exercise his or her right to opt-out of such sales. The business must provide at least two designated methods for submitting requests to opt-out. If the business operates a website or mobile app, at least one method must include an interactive form accessible via a clear and conspicuous link on the website or mobile app titled "Do Not Sell My Personal Information," or "Do Not Sell My Info."

Other acceptable methods for submitting these requests include, but are not limited to, a toll-free telephone number, a designated email address, a form submitted in person, a form submitted through the mail, or user-enabled global privacy controls (such as a browser plugin, privacy setting, device setting or similar mechanism that clearly communicates or signals the consumer's choice to opt out of the sale of their personal information).

At least one method offered for requests to opt-out must reflect the manner in which the business primarily interacts with the consumer. For example: if a business operates a website but primarily interacts with its customers in-person at a brick-and-mortar store, the business would need to offer a form that can be submitted in-person at the retail location in addition to the other methods it makes available for submitting requests to opt-out.

The proposed regulations emphasize that a business's methods for consumers to submit requests to opt-out must be easy to execute and require minimal steps to allow the consumer to opt-out. Additionally, a business must not utilize a method that is designed with the purpose or has the substantial effect of subverting or impairing a consumer's decision to opt-out. Methods that require a lot of steps, take a lot of time, or are otherwise frustrating or difficult to navigate for consumers run afoul of both the spirit of the statute and the text of the proposed regulations, and businesses should design their request to opt-out submission processes accordingly.

Please note: If a business collects personal information from consumers online, the business must treat user-enabled global privacy controls, such as a browser plugin, privacy setting, device setting or other similar mechanism that clearly communicates or signals the consumer’s choice to opt out of the sale of their personal information, as a valid request to opt-out with respect to the applicable browser or device (and, if known, the consumer using the browser or device), regardless of whether the consumer has separately submitted a request to opt-out through one of the business's designated methods.

The CCPA does not specify how businesses should treat consumers' requests to opt-out that are not submitted through one of the business's designated methods. Until further guidance is provided, the business's safest course of action would be to comply with the consumer’s request to opt-out regardless of the form in which the request is submitted.

Required Employee Training

In the proposed regulations, businesses are required to provide certain training to individuals responsible for handling consumer requests under the CCPA. This training must cover the business's privacy practices, the business's CCPA compliance efforts, and how the employee should direct consumers to be able to exercise their rights under the CCPA.

Tip #6: Verifying Consumers' Identity in Requests to Know/Delete

Published Feb. 27. Updated April 2. 

After receiving a consumer's properly submitted "request to know" or "request to delete," a business's first step is to verify the identity of the individual making the request. The concern, of course, is that a bad actor may pretend to be a particular consumer in order to gain unauthorized access to, or cause the unauthorized deletion of, that consumer's personal information. This Practice Tip will focus on the duty to establish reasonable methods to verify consumers' identities in connection with requests to know or delete and will provide some specific guidance for businesses.

The Burden to Verify

The CCPA and the proposed regulations place the burden on businesses to establish a "reasonable method" for verifying consumer identities in connection with consumer requests to know and requests to delete. This can put businesses in a difficult position. On one hand, businesses must comply with properly submitted and verifiable requests to know or delete, and they cannot create unreasonable hurdles for consumers submitting such requests. On the other hand, a business could be held responsible for a failure to "implement reasonable security measures to detect fraudulent identity-verification activity and prevent the unauthorized access to or deletion of a consumer's personal information." Verification procedures that are too difficult for consumers to navigate may cause them to complain or create a perception that the business is intentionally putting up barriers so as not to comply with the CCPA. But verification procedures that are not stringent enough may leave consumers' personal information exposed and violate the business's fraud prevention and data security obligations under the CCPA.

Precisely what constitutes a "reasonable method" for verifying identities is not spelled out in any detail in the text of the CCPA. The proposed regulations do provide a clear mechanism to verify a consumer's identity in the scenario where the consumer maintains a password-protected account with the business (described in further detail below), but for all other scenarios businesses are given only limited guidance and examples. Additional guidance may be forthcoming, whether in the form of revised regulations from the California attorney general, interpretations of the existing regulations through disputes worked out in the courts, or commonly understood "best practices" across the industry. In the meantime, a business will need to navigate this "verification" step with particular caution.

Identity Verification for Consumers with Password-Protected Accounts

According to the proposed regulations, if the consumer maintains a password-protected online account with a business through the business's website, mobile application or other online service, then the business may utilize this existing authentication process to verify the consumer's identity. Specifically, upon receiving a consumer's request to know or delete personal information, the business would ask the consumer to log in to their existing password-protected account so as to authenticate their identity by entering their username and password. Once the consumer has completed this step, the consumer could then be directed to submit their request to know or delete through a secure, self-service portal made available by the business for this purpose.

In this scenario, even if the consumer submits a request by calling in to the business's toll-free telephone number, using an online webform or any other method, the proposed regulations permit the business to respond by directing the consumer to log into their existing password-protected account to verify their identify and use the self-service portal. This approach has the dual advantages of utilizing the business's existing, secure online authentication practices and funneling all consumer requests through a single, consistent and efficient process, regardless of the origin of the request.

Identity Verification for Consumers without Password-Protected Accounts

For businesses that do not maintain password-protected accounts for consumers, it will be trickier to verify consumers' identities. The California attorney general's proposed regulations spell out some general requirements for how a business must work to verify the consumer's identity:

Requests to Opt-Out of Sales Are Different

Requests to opt-out of the "sale" (as defined in the CCPA) of a consumer's personal information are treated differently under the CCPA and do not need to be verified. Because the policy concerns of accidentally disclosing or deleting a consumer's personal information are not present, a business may deny a request to opt-out only if the business has a good-faith, reasonable and documented belief that the request is fraudulent. Even then, the business must notify the consumer that it will not comply with the request and explain why the business believes the request is fraudulent.

Tip #7: Responding to a Consumer's "Request to Know"

Published March 5

Under the CCPA, consumers have a right to request information about the personal information a business has collected about that consumer (a "request to know"). In connection with a valid, verifiable request to know, a consumer may request (and a business must provide in its response) one or more of the following pieces of information:

  1. The categories of personal information the business has collected about that consumer in the preceding 12 months;
  2. Specific pieces of personal information the business has collected about that consumer in the preceding 12 months;
  3. The categories of sources from which the personal information is collected;
  4. The business or commercial purpose for collecting or selling the consumer's personal information;
  5. The categories of third parties with which the business shares personal information;
  6. The categories of personal information that the business sold in the preceding 12 months, and for each category identified, the categories of third parties to which it sold that particular category of personal information (or, if the business has not sold any of the consumer's personal information in the preceding 12 months, a statement to this effect); and
  7. The categories of personal information that the business has disclosed for a business purpose in the preceding 12 months, and for each category identified, the categories of third parties to whom it disclosed that particular category of personal information (or, if the business has not disclosed for a business purpose any of the consumer's personal information in the preceding 12 months, a statement to this effect).

General Guidance for Providing a Response

The response to the consumer must be an individualized response. It should not just refer the consumer to the business's general practices outlined in its privacy policy unless this response would be the same for all consumers and the privacy policy discloses all the information that is required to be in the response to the consumer. The information may be delivered by mail or electronically, using reasonable security measures. If delivered electronically, it must be in a portable and, if feasible, readily usable format that allows the consumer to transmit this information to another business without hindrance. (The so-called "portability" requirement.) If the consumer has a password-protected account with the business, the business may comply with a request to know by using a secure self-service portal for consumers to access, view and receive a portable copy of their personal information.

Additionally, a business is not permitted to charge a fee to the consumer in connection with the consumer's request to know. However, the business is only required to respond to a request to know from a particular consumer a maximum of two times in a 12-month period.

1.  Requests for Categories of Personal Information

A consumer may request information about the "categories of personal information" the business has collected about the consumer. "Categories of personal information" refers to the categories described in our previously published CCPA Practice Tip #3: "identifiers," "characteristics of protected classifications," "commercial information," "biometric information," etc. If a consumer requests information about the "categories of personal information" the business has collected about the consumer, the business could respond by listing out the categories and indicating whether the business has collected any information about the consumer within the specified category. The purpose is to identify for the consumer, generally, the types of personal information the business has collected about the consumer.

2.  Requests for Specific Pieces of Personal Information

A consumer may request the specific pieces of personal information the business has collected about the consumer. As an example, if the business collects the consumer's first and last name, and the consumer's first and last name is John Smith, then the business should respond by indicating that the business has collected "identifiers" about John Smith, including that 'John Smith" is the consumer's first and last name. As a further example, if the business has in its records that John Smith weighs 195 pounds, the business should respond by indicating that the business has collected "biometric information" about John Smith, including the fact that John Smith weighs 195 pounds. Keep in mind that specific information is only required to be disclosed to the consumer if it is maintained by the business in identifiable form, i.e., linked with or reasonably capable of being linked with a particular, identifiable consumer. The information is not "personal information" (and thus does not need to be disclosed in response to a valid request to know) if the information is maintained in de-identified or aggregated form only.

Notwithstanding the foregoing, the CCPA specifically states that, in connection with a request to know, a business should not at any time disclose a consumer's social security number, driver's license number or other government-issued identification number, financial account number, any health insurance or medical identification number, account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of the consumer's characteristics. In other words, in response to a request to know, the business (per items #1, #5, #6 and #7 in the list above) should indicate that it has collected this type of information and that it has sold or disclosed this type of information to third parties (and the categories of third parties to whom it has sold or disclosed the information), in each case where it is true, but the business should not (per item #2 in the list above) actually disclose the specific pieces of information in these prohibited categories to the consumer.

Under certain limited circumstances, a business is not required to exhaustively search its systems and records for specific pieces of personal information about a particular consumer in response to the consumer's request to know. This is true if all of the following conditions are met: (1) the business does not maintain the personal information in a searchable or reasonably accessible format, (2) the business maintains the personal information solely for legal or compliance purposes, (3) the business does not sell the personal information and does not use it for any commercial purpose, and (4) the business, in its response to the consumer, describes to the consumer the categories of records that may contain personal information that the business did not search because it met the conditions stated above.

3.  Requests for Categories of Sources

A consumer may request the "categories of sources" from which the personal information is collected. This refers to the types or groupings or persons or entities from which a business collects personal information about consumers. Examples include from the consumer directly, advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks and data brokers.

4.  Requests for the Business Purpose and Commercial Purpose for Collecting or Selling the Consumer's Personal Information

A consumer may request to know the "business purpose" or "commercial purpose" that a business has for collecting or selling a consumer's personal information. These terms have specific meanings under the CCPA.

A "business purpose" is the use of personal information for the business's (or its service provider's) operational purposes, or for other notified purposes that are reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or to achieve another operational purpose that is compatible with the context in which the personal information was collected. Business purposes include the following:

A "commercial purpose" is any use that advances a person's commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide or exchange products, goods, property, information or services, or enabling or effecting, directly or indirectly, a commercial transaction.

5, 6 & 7.  Requests for Categories of Third Parties

A consumer may request the "categories of third parties" to whom the business has sold or disclosed for a business purpose the consumer's personal information. "Categories of third parties" refers to the types or groupings of third parties with whom the business shares personal information. Examples include advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks and data brokers.

Tip #8: Responding to a Consumer's "Request to Delete"

Published March 12

Upon a business's receipt of a valid, verifiable request from a consumer to delete the personal information the business has collected about that consumer (a “request to delete”), the business must delete the consumer's personal information from its records, and it must direct any service providers with whom it has shared the consumer's personal information to do the same. 

A business may "delete" the personal information by doing one of the following:

  1. Permanently and completely erasing the personal information on its systems. With respect to archived or back-up systems, the proposed implementing regulations permit the business to delay permanently and completely erasing the personal information until the archived or back-up system is restored to an active system or until the archived or back-up system is next accessed or used by the business for a sale, disclosure or commercial purpose (and otherwise the business may allow the personal information to be deleted in the ordinary course of the business's data retention policies for the archived or back-up system).
  2. De-identifying the personal information.
  3. Aggregating the information.

"De-identify" has a specific meaning under the CCPA. It means to make sure the information cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, and the business must also (1) implement technical safeguards and processes that prohibit and prevent re-identification, (2) implement processes to prevent inadvertent release of de-identified information and (3) make no attempt to re-identify the information.

"Aggregate" information is information that relates to a group or category of consumers, from which individual consumer identities have been removed, and that is not linked or reasonably linkable to any consumer or household, including via a device linked with the consumer or household.

Finally, the business must provide a written response to the consumer informing the consumer whether or not the business has complied with the request (see below and Practice Tip #9 for exceptions and grounds for denying a request) and state in such response that it will retain a record of the consumer's request as required by California Civil Code Section 1798.105(d) (see Practice Tip #9 for more information regarding recordkeeping requirements in connection with consumer requests).

Exceptions to Requests to Delete

This obligation to delete is not absolute. Notable exceptions where the business will be permitted to retain personal information, despite a valid, verifiable request to delete, include the following: 

Even if one or more exceptions apply, the business is still obligated to delete all personal information which is not necessary to be retained under the applicable exception(s), and the business must also implement a sunsetting mechanism for any personal information that is retained under an exception (i.e., delete the personal information when the exception no longer exists). For example, if a consumer purchased a product with a three-year warranty and then requests deletion of his or her personal information after six months, the business would be obligated to immediately delete all personal information that is not necessary for the business to process a potential future warranty claim (unless another, separate exception applies), and then, at the end of the third year when the warranty has expired, the business should delete the rest of the consumer's personal information. Further, the business is not permitted to use retained personal information for any purpose except for the purpose provided for by the relevant exception.

Next week's Practice Tip will take a step back and cover the general mechanics of responding to both requests to know and requests to delete, including the timing of the business's response, grounds for the business denying a request, and recordkeeping requirements imposed on the business by the CCPA.

Tip #9: Additional Requirements for Responding to Requests to Know/Delete

Published March 20

Previous installments in this CCPA Practice Tip Series have provided guidance on the specific requirements for responding to a consumer's request for information about the personal information a business has collected about that consumer (a "request to know") or for responding to a consumer's request to delete the personal information the business has collected about that consumer (a "request to delete"). This installment provides further guidance on requirements that apply across both types of requests, including the deadline for responding, grounds for denying requests, recordkeeping requirements, dealing with requests for household information and processing requests from a consumer's authorized agent.

Deadline for Responding to Requests

Upon receiving a valid, verifiable request to know or request to delete, the business must:

A business may provide its initial confirmation in the same manner in which the request was received. For example, if the request is made over the phone, the confirmation may be given on the phone during the phone call with the consumer making the request.

If necessary, the business may take up to an additional 45 calendar days to respond to the request (for maximum total of 90 days from receipt of the request) so long as the business notifies the consumer and explains the reason the business needs additional time.

Denying Requests

A business is not obligated to comply with a request to know or request to delete and may deny the request under the following circumstances:

The denial response must be submitted to the consumer in writing. If the business denies a consumer's request because it is not properly submitted, the business must at a minimum provide directions to the consumer on how to properly submit the request. If the business denies a consumer's request for any other reason, it must explain the basis for the denial (i.e., cite the exception that applies). 

Finally, if the business denies a request to delete and that business also sells consumers' personal information, then, unless the business is aware that the consumer has already made a request to opt-out of sales of his or her personal information, the business must ask the consumer if the consumer would like to opt-out of such sales and include the contents of or a link to the business's "Do Not Sell My Personal Info" disclosure.

Recordkeeping Requirement

Businesses must maintain records of consumers' requests under the CCPA and how the business responded for at least 24 months. Each record should include the date of the request, the nature of the request, the manner in which the request was made, the date of the business's response, the nature of the response, and the basis for the denial of the request if the request is denied in whole or in part. Information maintained for recordkeeping purposes may not be used for any other purpose except as reasonably necessary for the business to review and modify its processes for compliance with the CCPA. This information also may not be shared with any third party (other than any third parties that qualify as the business's "service providers" under the CCPA) except as necessary to comply with a legal obligation.

Requests to Access or Delete Household Information

HouseholdsThe CCPA is unusual in that it defines personal information as information that relates to a particular consumer or household. One consequence is that a consumer's right to submit a request to know and request to delete technically provides the consumer with a right of access to (or a right to delete) the personal information of other members of the consumer's household. Businesses must comply with these requests, subject to the following further guidance provided in the proposed regulations:

We recommend consulting with a Robinson Bradshaw attorney before responding to any request to know or request to delete as it pertains to household personal information.

Consumers' Use of Authorized Agents

Consumers are permitted to designate one or more authorized agents to make requests to know and requests to delete on their behalf. Businesses are permitted to require the authorized agent to submit proof that the agent has actually been authorized to act on the consumer's behalf. Additionally, if the authorized agent submits a request to know or request to delete on a consumer's behalf, the business is still permitted to require the consumer to verify the consumer's own identity using the business's typical verification process and require the consumer to directly confirm with the business that the consumer provided the authorized agent permission to submit the request, unless the consumer has provided the agent with a valid power of attorney (in which case the business is prohibited from separately requiring the consumer to take these additional actions).

We recommend consulting with a Robinson Bradshaw attorney before dealing with any requests to know or requests to delete purporting to come from a consumer's authorized agent.

Tip #10: Responding to Requests to Opt-Out

SalesPublished March 27

The past few Practice Tips have focused on requests to delete and requests to know. This Practice Tip will focus on how a business that sells consumers' personal information should respond to a consumer's request to opt-out of the sale of the consumer's personal information (a "request to opt-out"). Recall that Practice Tip #5 (Submission of Consumer Requests) describes methods a business must make available for consumers to submit requests to opt-out (assuming the business sells consumers' personal information).

Businesses that do not sell consumers' personal information and include a statement confirming this in their privacy policy are not required to make methods available for consumers to submit requests to opt-out or respond to consumers' requests to opt-out.    

General Timeline and Response

According to the proposed CCPA implementing regulations, a business that sells consumers' personal information must comply with a request to opt-out as soon as feasibly possible, but no later than 15 business days after the date the business receives the request.   

Also according to the proposed regulations, in response to a request to opt-out, a business may present a consumer with the choice to opt-out of sales for only certain uses of the consumer's personal information as long as there is a global option to opt-out of all sales of the consumer's personal information and the global option is presented more prominently than the other choices.

To comply with a request to opt-out, the business must do the following:

  1. Going forward, refrain from selling personal information collected by the business about the consumer that made the request;
  2. Respect the consumer's decision to opt-out for at least 12 months before requesting that the consumer authorize the sale of the consumer's personal information; and
  3. Per the proposed regulations, if a business sells the consumer's personal information to any third parties after the consumer submits his or her request but before the business actually complies with the request, the business must notify those third parties of the consumer's request to opt-out and direct those third parties not to sell that consumer's information.

Except in the very specific circumstances described in no. 3 above, a business is not required to notify third parties to whom the business has sold the consumer's personal information of the consumer's request to opt-out, nor is the business required to direct third parties to whom the business has sold the consumer's personal information to refrain from further selling the consumer's personal information.

As with requests to know and requests to delete, a business must maintain records of consumer's requests to opt-out and how the business responded to those requests for at least 24 months. Please see Practice Tip #9 for a summary of the CCPA recordkeeping requirements applicable to consumer requests.

Limited Reasons for Denying a Request to Opt-Out

Neither the CCPA nor the proposed regulations specify how a business should treat consumers' requests to opt-out that are not submitted through one of the business's designated methods. Therefore, until further guidance is provided, a business's safest course of action would be to comply with a consumer's request to opt-out regardless of the form in which the request is submitted.

A request to opt-out does not have to be verifiable. However, a business may deny a request to opt-out if the business has a good-faith, reasonable and documented belief that a request to opt-out is fraudulent. Even then, the business must inform the requestor that it will not comply with the request and provide an explanation for why it believes the request is fraudulent. 

Finally, a consumer may designate an authorized agent to submit a request to opt-out on the consumer's behalf if the consumer provides the authorized agent signed, written permission. A business may deny a request if an authorized agent fails to submit proof that the agent is authorized by the consumer. However, the proposed regulations state that a global privacy control that signals a consumer's choice to opt-out of the sale of their personal information will be considered a request directly from a consumer and not as being submitted by an authorized agent.

User-Enabled Global Privacy Controls and Requests to Opt-Out

It is worth noting again that the proposed regulations permit requests to opt-out to be submitted through a user-enabled global privacy control (such as a browser plug-in, privacy setting or device setting) if the business collects personal information from consumers online and so long as the privacy control clearly communicates or signals that a consumer intends to opt-out of the sale of personal information. If a consumer's browser or device signals or communicates the consumer's choice to opt-out of the sale of the consumer's personal information, then the business must treat this the same as a request to opt-out received directly from the consumer and respond accordingly.

According to the proposed regulations, if the signal or communication from a global privacy control conflicts with the consumer's existing business-specific privacy settings or the consumer's participation in a business's financial incentive program, the business must still comply with the request to opt-out submitted in this fashion, but may notify the consumer of the conflict and give the consumer the choice to confirm the consumer's business-specific privacy setting or participation in the financial incentive program.

Opting Back In

Consumers may be given the choice to opt back in to the sale of their personal information, but such choice must be a two-step process where the consumer needs to (1) clearly request to opt-in to the sale of their personal information and (2) separately confirm their choice to opt-in.

If a consumer who submitted a request to opt-out later initiates a transaction or attempts to use a service that requires the sale of the consumer's personal information, the business should inform the consumer that the transaction or service requires the sale of their personal information and provide instructions on how to opt-in to the sale of their personal information using the business's two-step process.

Tip #11: Data Security Obligation

Published April 2

Tip 11 boxThe CCPA and California Civil Code Section 1798.81.5 give businesses an affirmative "duty to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect [a consumer’s] personal information." This duty can be enforced by the California attorney general just like other parts of the CCPA. However, this duty can also be enforced by the consumer directly through a limited private right of action. The CCPA provides that where a business's violation of the duty of reasonable security leads to unauthorized access and exfiltration, theft, or disclosure of a consumer's non-encrypted and non-redacted personal information, then under certain circumstances that consumer would be able to sue the business for statutory damages of not less than $100 and up to $750 per incident (or actual damages, if they are greater) and other court-ordered relief. This could pave the way for class action lawsuits based on data breaches, with a potential award calculated by the number of consumers affected. Thus, businesses should be prepared to demonstrate how they have complied with the "duty to implement and maintain reasonable security procedures and practices."

Notably, neither the CCPA nor Section 1798.81.5 defines what would constitute "reasonable security" to satisfy this duty. The answer will depend, in part, on the type, amount and sensitivity of the personal information; on available technology and on what are considered "industry standard" and "best practices" within the business's industry. Notably, in her 2016 data breach report, then-California Attorney General Kamala Harris explained that "[a]uthoritative security standards describe the measures that organizations should take to achieve an appropriate standard of care for personal information" and specifically concluded: "The 20 controls in the Center for Internet Security's Critical Security Controls define a minimum level of information security that all organizations that collect or maintain personal information should meet. The failure to implement all the Controls that apply to an organization's environment constitutes a lack of reasonable security." Accordingly, at a minimum, businesses should map their data security program onto an authoritative security standard such as the Center for Internet Security's Critical Security Controls. However, a business should also consider working with a reputable data security firm to ensure that its security procedures and practices meet or exceed the best practices and authoritative frameworks for the relevant industry.

Section 1798.81.5 also specifies that a business that discloses personal information under a contract with an unaffiliated third party must in the contract require the third party to adhere to the same duty of reasonable security. Thus, businesses should conduct an audit of relevant third-party contracts to ensure they properly address data security.

Tip #12: Service Providers and the CCPA

Published April 10

For the most part, the CCPA's requirements only apply directly to the business "that collects consumers' personal information or on behalf of which that information is collected and that alone, or jointly with others, determines the purposes and means of the processing of consumers' personal information." But very often businesses engage other parties to help them process consumers' personal information, such as a payment processor, a hosting services provider, or a provider of cloud-based software to help with customer relationship management or managing support services requests. Businesses covered by the CCPA must get these service providers to sign written contracts featuring specific contractual provisions. Businesses that fail to do so risk having any transfers of personal information to such parties be deemed a "sale" of that information (triggering additional compliance obligations) or being held directly liable for such parties' misconduct. This Practice Tip explores businesses' obligations with respect to the service providers they engage to process personal information on their behalf, as well as service providers' own, limited set of direct obligations under the CCPA.

"Service Provider" Defined

Under the CCPA, a "service provider" is a for-profit entity that processes consumers' personal information on behalf of a business while performing services specified in a written contract with the business. The written contract must, at a minimum:

  1. Prohibit the service provider from selling the personal information (within the meaning of the CCPA);
  2. Prohibit the service provider from collecting, retaining, using or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract, including collecting, retaining, using or disclosing the personal information for a commercial purpose other than providing the services specified in the contract;
  3. Prohibit the service provider from retaining, using or disclosing the personal information outside of the direct business relationship between the service provider and the business; and
  4. Include a certification by the service provider that the service provider understands these restrictions and will comply with them.

In addition, if the service provider will be handling information that constitutes "personal information" as more narrowly defined by California Civil Code Section 1798.81.5 (see Practice Tip #11), then the written contract must also include a requirement for the service provider to implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, exfiltration, theft or disclosure.

Often the above-described contractual provisions will appear in an appendix or exhibit to the written services contract between the business and service provider, commonly called a CCPA Addendum.

As clarified in the proposed CCPA implementing regulations, service providers do not themselves have to qualify as a business as defined by the CCPA in order to be a "service provider" under the CCPA.

Negotiating a CCPA Addendum

Although not specifically required like the above four provisions, businesses should also consider adding the following additional provisions to a CCPA Addendum:

In turn, service providers often will want to clarify in the CCPA Addendum (as the proposed regulations permit) that the service provider may also use the personal information:

Why Businesses Should Want to Confirm the "Service Provider" Status of Third-Party Providers

As described in further detail in Practice Tip #3, a business's transfer of a consumer's personal information to a "service provider" is not a sale of the information under the CCPA. Businesses that sell consumers' personal information are subject to additional compliance obligations under the CCPA. These additional requirements do not apply to transfers made to "service providers."

Additionally, under the CCPA a business is insulated from liability in the case where its "service provider" uses personal information in violation of the CCPA's restrictions. The service provider will be directly liable for such violations. By contrast, a business that transfers a consumer's personal information to some other third party that is not a "service provider" could be found to be secondarily liable for the misconduct of that third party.

Service Providers' Direct Obligations Under the CCPA

Service providers have few direct obligations under the CCPA and the corresponding proposed regulations. The obligations are limited to the following:

Service providers can be held directly liable under the CCPA for violating the requirements that are directly applicable to service providers. However, service providers are not liable under the CCPA for violations of the CCPA by the business for which it provides services.

Tip #13: Treating Consumers Differently

Published April 30

To encourage the free exercise of CCPA rights, the CCPA prohibits a business from treating a consumer differently based on the consumer's exercise of CCPA rights – called "discriminating" in the statute. As explained in the CCPA, this would include treating the consumer differently by (1) denying goods or services to the consumer, (2) charging different prices or rates for goods or services, (3) providing a different level of quality of goods or services, or (4) suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services. However, somewhat paradoxically, the CCPA further provides that a business may offer financial incentives (e.g., paying a consumer) for the collection, sale or deletion of personal information, and may offer different prices, rates, levels or quality of goods or services to the consumer if that price or difference is directly related to the value of the customer's data to the business. This Practice Tip will focus on how businesses navigate these challenging CCPA provisions, such as with membership or rewards programs.

The text of the CCPA provides no further guidance on how to implement this requirement that treating a consumer differently based on the consumer's exercise of CCPA rights must be "directly related to the value provided to the business by the consumer's data." However, the California attorney general provided some guidance with the release of the proposed implementing regulations and the subsequent modifications. The proposed regulations require that a business offering a financial incentive or difference in price or quality based on the consumer's exercise of CCPA rights may do so only if "it is reasonably related to the value of the consumer's data," and the business must "use and document a reasonable and good faith method for calculating the value of the consumer's data." Furthermore, the proposed regulations provide that this method of calculation must consider one or more of the following factors:

  1. The marginal value to the business of the sale, collection or deletion of a consumer's data;
  2. The average value to the business of the sale, collection or deletion of a consumer's data or a typical consumer's data;
  3. The aggregate value to the business of the sale, collection or deletion of consumers' data divided by the total number of consumers;
  4. Revenue generated by the business from the sale, collection or retention of consumers' personal information;
  5. Expenses related to the sale, collection or retention of consumers' personal information;
  6. Expenses related to the offer, provision or imposition of any financial incentive or price or service difference;
  7. Profit generated by the business from sale, collection or retention of consumers' personal information; and
  8. Any other practical and reasonably reliable method of calculation used in good-faith.

Consumer NoticeIn addition to spelling out this framework, the proposed regulations provide four "illustrative examples" that suggest how the California attorney general will approach enforcement of the anti-discrimination provision of the CCPA:

Notably, the California attorney general's examples fail to illustrate how the business in each scenario reasonably calculated the value of the consumer's data. However, the second example illustrates an important exception, clarified in the proposed regulations, that a business's denial of a consumer's request to know, request to delete or request to opt-out for reasons permitted by the CCPA or the proposed regulations would not be considered discriminatory. Similarly, the proposed regulations clarify that a price or service difference that is the direct result of compliance with a state or federal law also will not be considered discriminatory. The underlying logic here seems to be that such price or service differences are not retaliation against the consumer for exercising CCPA rights.

Tip #14: Government Enforcement

Published June 4

The California attorney general may begin enforcing the CCPA on July 1, 2020. This may include making investigative demands and initiating enforcement actions against businesses for violating the CCPA. Furthermore, consumers have already begun filing lawsuits under the CCPA's limited private right of action for a data breach resulting from a business's violation of the duty of reasonable security discussed in Practice Tip #11. This Practice Tip will focus on the enforcement of the CCPA by the California attorney general, whereas a later Practice Tip will discuss private litigation under the CCPA.

The CCPA grants enforcement authority to the California attorney general. Although it went into effect on Jan. 1, 2020, the CCPA provides that the attorney general may not commence enforcement until the earlier of July 1, 2020, or six months after the publication of final regulations. As no final regulations were published by the spring of 2020, the California attorney general will be able to commence enforcement on July 1. A coalition of businesses sent an open letter in March calling for the start of enforcement to be postponed in light of the COVID-19 public health emergency, but the California attorney general responded that he had no plans to delay enforcement.

Advisory opinionBy its terms, the California attorney general will enforce the CCPA by providing notice of alleged noncompliance and then filing a civil action to recover injunctive relief and assess monetary penalties. However, the law indicates that a business could avoid liability if it cures an alleged violation within 30 days after being notified. The statute does not define how a violation may be "cured" in this context, nor do the California attorney general's proposed regulations provide any explanation. Presumably a deficient privacy policy or vendor agreement would be able to be cured by revising its language. However, could a business cure an unauthorized disclosure of a consumer's personal information to a third party? How about a failure to maintain records of consumer requests? Questions like these remain to be answered by the California attorney general or by judges in the course of litigation.

Notably, the investigation of the business would likely begin well before the California attorney general files a civil action or even provides notice of alleged noncompliance. As detailed in Cal. Gov. Code § 11181, the attorney general has a number of "pre-litigation" investigative powers at his disposal, including the authority to inspect and copy business records and other materials; to issue subpoenas requiring the production of such materials; to promulgate interrogatories; and to issue subpoenas for witness testimony. A business that receives such demands would be obligated to comply and could face penalties for refusing to cooperate. For example, the California attorney general sued Facebook last year to enforce a subpoena and interrogatories which the attorney general had served on the social media giant to investigate its privacy practices.

In regard to penalties for violating the CCPA, the law provides that any business, service provider or other person that violates the statute will be liable for a civil penalty of not more than $2,500 for each violation or $7,500 for each intentional violation. In addition, for its requirement that data brokers register as such with the California attorney general, the CCPA provides that a data broker failing to register as required will be subject to injunction and liable for (i) a civil penalty of $100 per day of non-registration along with (ii) any unpaid fees and (iii) the expenses incurred by the California attorney general to investigate and prosecute the enforcement action.

In considering one's potential liability, a great deal may depend on how "intentional" and "for each violation" are interpreted in this context. Neither the CCPA nor the California attorney general's proposed regulations provide any explanation – though the statutory penalty of $100 per day for unregistered data brokers suggests the possibility of penalizing separate days of noncompliance as separate violations. A violation of the CCPA impacting multiple consumers might also be argued to warrant penalties for separate violations. However it unfolds, this will be another important issue to watch closely as the California attorney general begins bringing enforcement actions and courts begin imposing penalties.

Tip #15: Consumer Litigation

Published July 16. This tip was prepared with the assistance of Lauren Jones, a rising 3L student at Vanderbilt University Law School.

In addition to the general enforcement by the California attorney general, the CCPA provides a limited private right of action to enforce the CCPA through private civil litigation concerning data breaches. Broadly speaking, the CCPA sometimes allows a consumer to bring a civil lawsuit where a business's violation of the duty of reasonable data security described above in Practice Tip #11 leads to a breach of the consumer's non-encrypted and non-redacted personal information. This final Practice Tip in our series will explore the contours and implications of this limited private right of action for data breaches.

In contrast to other parts of the CCPA, the limited private right of action for data breaches concerns a narrower definition of personal information taken from California's breach notification statute. In this context, the term "personal information" includes an individual's first name or initial and last name in combination with any of the following data elements (when either the name or the data elements are not encrypted or redacted):

The CCPA provides that, when such personal information is subject to unauthorized access and exfiltration, theft or disclosure as a result of a business's violation of the duty of reasonable data security described in Practice Tip #11, then the consumer may bring a civil action for any of the following:

Regarding the amount of statutory damages to award, the CCPA requires the court to consider one or more relevant circumstances presented by any of the parties, including the following:

The availability of statutory damages is significant, as data breach lawsuits are often stymied by the challenge of proving actual damages from a breach of personal information when that information has not yet been exploited for identity theft. In particular, the availability of statutory damages makes it far easier to bring a class action lawsuit on behalf of the set of consumers whose personal information was compromised during a data breach. 

Perhaps with this in mind, the CCPA created an extra hurdle for lawsuits to recover statutory damages. The statute provides that, prior to being able to sue for individual or class-wide statutory damages, a consumer must provide the business 30 days' written notice identifying the specific provisions of the CCPA that the consumer alleges have been or are being violated. Then, in the event a cure is possible, the business can avoid facing a lawsuit for individual or class-wide statutory damages if, within the 30 days, the business actually cures the noticed violation and provides the consumer an express written statement that the violations have been cured and that no further violations shall occur. However, if the business later violates the express written statement, then the consumer may bring an action for individual or class-wide statutory damages to enforce that express written statement and any subsequent CCPA violation covered by the limited private right of action. Of course, it remains to be seen what types of CCPA violations may be "cured" so as to foreclose class action litigation following a data breach, as well as how plaintiffs and defendants will navigate these pre-litigation requirements of written notice of an alleged violation and of an express written statement of the cure and compliance. In the first class action lawsuit under the CCPA's limited private right of action, Fuentes v. Sunshine Behavioral Health, No. 8:20-cv-00487-JLS-JDE (C.D. Cal.) filed on Mar. 10, 2020, the court has not yet addressed these issues at the time of writing.

Finally, the CCPA emphasizes the limited nature of this limited private right of action for data breaches, stating that "[t]he cause of action established by this section … shall not be based on violations of any other section of this title" and "[n]othing in this title shall be interpreted to serve as the basis for a private right of action under any other law." Notwithstanding, numerous lawsuits filed after the CCPA went into effect on Jan. 1, 2020, have looked for ways to broaden the scope of CCPA enforcement through private litigation. For example, in Burke v. Clearview AI, Inc., No. 3:20-cv-00370 (S.D. Cal.), a putative class action filed on Feb. 27, 2020, alleges violations of the CCPA's requirement for consumer notice in order to seek relief under California's Unfair Competition Law – which allows class actions to enjoin unfair, fraudulent or unlawful business practices, and recover restitution and attorney's fees.

Added to the uncertainty from early CCPA litigation, there are ongoing efforts to expand the scope of the limited private right of action. In particular, the same group whose ballot initiative led to the CCPA's enactment in 2018 announced on May 4, 2020, that they have been able to collect enough signatures to add their proposed California Privacy Rights Act (CPRA) to the November 2020 ballot in California. Among many other legal changes, this initiative would expand the scope of "personal information" under the CCPA's limited private right of action to include a consumer's username or email address in combination with a password or security question and answer that would permit access to an online account.

Attorneys at Robinson Bradshaw will continue to monitor developments related to the CCPA and other state, federal and foreign privacy and data protection laws affecting our clients. Click here to subscribe to our Cybersecurity & Privacy list and receive future updates via email, including our ongoing series of quarterly legal updates that highlight noteworthy developments of cybersecurity and privacy law from the previous quarter. 

Main Menu