Getting Ready for Wide-Ranging Reach of California's Data Privacy Law

Another area that makes the CCPA stand out is its broad definitions of personal information and sale. The CCPA definition of PI includes “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This is perhaps the broadest definition of PI in U.S. legal history.

The definition of sale is no less expansive. Sale is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic or other means a consumer's personal information by one business to another business or a third party for monetary or other valuable consideration.”

It's the “valuable consideration” piece that becomes particularly problematic. When businesses are forced to look at data transfers that might include non-public information that falls under the CCPA's broad definition of PI, coupled with the question of whether they receive any “valuable consideration” for that exchange of data, a lot of previously innocuous business activities start to fit the definition of a sale of PI.

The CCPA requires that a company's customer-facing privacy policies must include detailed information about consumers' rights under the CCPA, as well as disclosing what categories of PI that company actually collects, how that data is used, and if the company sells PI, the types of entities the PI is sold to and the purpose for the sale.

The CCPA applies to companies that do business in California and meet one or more of the following three criteria: have more than $25 million in annual gross revenue (derived from business anywhere, not just California); buy, receive, sell or share the personal information of 50,000 or more consumers or devices; or derive 50% or more of their annual revenue from selling consumers' personal information.

California companies, and companies with significant online presences, are gearing up to meet these demands. The CCPA's definition of covered business is quite broad. As currently drafted, a company with $25 million in gross international revenue but only a few sales in California is subject to the law. Most companies with online sales deal with California consumers; California is the largest economy in the United States and the fifth largest economy in the world. No physical footprint within the state is required. Even a company with zero California customers might be doing business with a company covered under the CCPA.

The CCPA requires covered businesses to have certain provisions in their service-provider contracts limiting the use of data, in fact prohibiting “the entity receiving the information from retaining, using or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business.” In addition, depending on the nature of the agreement and the services provided, a company covered under the CCPA may need to alter its contract to ensure that it will assist in complying with consumer requests for access to, or deletion of, PI and to ensure compliance with consumer opt-out of sale requests. As described above, the broad definitions of PI and sale under the CCPA could make compliance with opt-out problematic. So, for those with contracts with U.S. companies that have more than $25 million in gross annual revenue may find it prudent to review those contracts now to be prepared to negotiate when counter-parties come calling.

The CCPA provides businesses with a limited time period to comply with consumer requests for access, deletion or to opt-out of the sale of their data. Such requests must be completed within 45 days (although the CCPA does allow for an additional 45-day extension if a response stating a valid reason the request cannot be completed in the allotted time is provided within the first 45 days). Notably, upon receiving a deletion request, the covered business must also “direct any service providers to delete the consumer's personal information from their records.” This means that, a business that has received PI from a covered business needs to be prepared to delete that information too — and do it quickly.

This is no easy task given the broad definition of PI. The information includes, but is not limited to: names, email addresses, physical addresses, bank account numbers, employment information, physical characteristics, purchase records, familial status, biometric data and educational information. Accordingly, while the CCPA does not specifically require companies to complete a data inventory, maintaining and understanding company data (e.g., applications, business processes and data sharing) may be a practical requirement to comply with the CCPA. Many companies that are directly subject to the CCPA are currently involved in these types of data mapping projects. Do other companies need to undergo the same process to meet their obligations to California business partners?

Since the CCPA was passed less than a year ago, Hawaii (SB 418), Maryland (SB 613), Massachusetts (SD 341), New Mexico (SB 176) and Rhode Island (S 0234) have advanced privacy bills that largely track the CCPA. In March 2019, the Washington state Senate passed a similar data privacy bill, although that legislation is modeled more on the European Union's General Data Protection Regulation (GDPR) (https://bit.ly/2wL1PYb), which provides many of the same rights, but also the right to correct collected personal data. It does not take a crystal ball (or a data privacy specialist) to recognize the trend toward additional consumer data privacy protections at the U.S. state level. In fact, a similar bill was introduced in New Jersey (A4902) in January.

Moreover, a federal privacy law may not be too far behind. In February 2019, both the U.S. House Subcommittee on Consumer Protection and Commerce, and the Senate Committee on Commerce, Science, and Transportation held hearings to explore the potential passage of a national privacy law. And the Federal Trade Commission scheduled hearings on its approach to consumer privacy as part of its Hearings on Competition and Consumer Protection in the 21st Century. Although no bipartisan solution has been reached, the federal government is paying close attention to these issues.

*****

Samuel Cullari is Philadelphia-based counsel in Reed Smith's intellectual property, tech and data group, focusing on the intersection of technology, privacy and data security. Alexis Cocco is a Philadelphia-based senior associate in the firm's intellectual property, tech and data group, focusing on data privacy defense litigation and compliance. This article also appeared in The Legal Intelligencer, an ALM sibling of Entertainment Law & Finance.