Data Points: Privacy & Data Security Blog

By Bret Buckler and Todd Taylor
Recently the state of California passed a data privacy and security law called the California Consumer Privacy Act (“CCPA”) (Assembly Bill 375, found here).

The law, which takes effect on January 1, 2020, is aimed at establishing a defined set of rights for consumers with regard to how their personal information is being collected and used.  The political push for the law comes on the heels of a contentious few months where tech giants such as Facebook have admitted to potentially problematic data breaches and oversharing of personal information, causing a groundswell of concern over the accountability of businesses in terms how they process, store, monetize, and share personal information. 

Some notable consumer rights under the CCPA include:

• A consumer has a right to request that a business disclose categories and specific pieces of personal information that the business has collected concerning the consumer, and must provide information if their collection practices change.
• After receiving a verifiable consumer request for such information, the business must provide such information to the consumer free of charge.
• A consumer has a right to request that a business delete any personal information about the consumer which the business has collected from the consumer.
• If a business sells consumers’ personal information to third parties, a consumer has the right, at any time, to stop the sale of their information (the right to “opt-out”).
• Consumers ages 16 and under are required to “opt-in” or affirmatively authorize the sale of their personal information before the business can make use of it in this way. Ages 13-16 may opt-in themselves, while those under 13 require a parent or guardian to opt-in on their behalf. 
• Consumers have a right to know categories of third parties with whom businesses are sharing their personal data. The business must provide a list of categories as set out in the CCPA.
• Consumers have a right to know the categories of sources of information from who personal data was acquired. The business must provide a list of categories as set out in the CCPA.
• Consumers have a right to know the business or commercial purpose of collecting personal information.
• The law is enforceable by the Attorney General of California. Consumers have a private right of action when a business breaches personal information. 

The CCPA is currently the most stringent state data privacy and security law of its kind.  As such, it sets a new precedent in the realm of state level data privacy laws.  Critics have used the term “sweeping” when referring to the nature of its broadly defined terms and potentially wide reach.  For instance, the definition of “personal information” under the CCPA includes expected categories of data such as real name, alias, postal address, email addresses, social security number, passport number and the like.  However, the definition also includes “unique identifiers,” which could be Internet Protocol addresses, cookies, beacons, pixel tags, mobile ad identifiers, geolocation data, and other similar data/technology. 

One loophole offered under the CCPA is gaining significant attention from online advertising agencies. Under CCPA § 1798.145, businesses may “[c]ollect, use, retain, sell, or disclose consumer information that is deidentified or in the aggregate consumer information” without any restriction imposed by the CCPA.  For now, it is not entirely clear whether the identifiers most widely used in online advertising space would qualify for this exception.  For instance, it may be possible to de-anonymize certain types of data, or it may be the case that certain seemingly de-identified data is actually tied to a device identifier, which in turn can be used to identify a user of the device and implicate CCPA rights and restrictions.

It’s also important to note that the CCPA does not apply to business that collect or sell consumers’ personal information if “every aspect of that commercial conduct takes place wholly outside of California.”  In order to qualify for this loophole, a business must be able to show: (1) personal information was collected while the consumer was outside of California; (2) no part of the sale of the information occurred in California; and (3) if the consumer was in California, no personal information collected while the consumer was in California has been sold.  This includes information that may have been stored on the user’s device while the consumer was in California and then later retrieved and stored while the consumer was outside of California.