California Enacted a Data Privacy Law. Why Should Companies in Other States Care?

Credit: Michal Bednarek/Photocreo/Shutterstock.com

 

In June 2018, the California Legislature passed the California Consumer Privacy Act (CCPA). The CCPA becomes effective on Jan. 1, 2020, and the California attorney general (and individual consumers, in some cases) can begin enforcement actions or file suit under the CCPA starting on July 1, 2020.

As you may have heard, the CCPA is a first of its kind, generally applicable data protection law for the United States. What makes the CCPA unique is not only its broad applicability to companies doing business across a various industries, but also the rights it provides to consumers regarding their personal information (PI).

Under the CCPA, California consumers are entitled to access, understand, and to some extent, exercise control over their PI that companies collect, use and sell. The CCPA provides those consumers with the right to request access to the PI that a company has collected the preceding 12 months, the right to request deletion of PI a company has collected directly from them, and the right to opt-out of any future sale of their PI.

Another area that makes the CCPA stand out is its broad definitions of personal information and sale. The CCPA definition of PI includes “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This is perhaps the broadest definition of PI in U.S. legal history.

The definition of sale is no less expansive. Sale is defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating orally, in writing, or by electronic or other means a consumer's personal information by one business to another business or a third party for monetary or other valuable consideration. It’s the “valuable consideration” piece that becomes particularly problematic.

When businesses are forced to look at data transfers that might include nonpublic information that falls under the CCPA’s broad definition of PI, coupled with the question of whether they receive any “valuable consideration” for that exchange of data, a lot of previously innocuous business activities start to fit the definition of a sale of PI.

The CCPA requires that a company’s customer-facing privacy policies must include detailed information about consumers’ rights under the CCPA, as well as disclosing what categories of PI that company actually collects, how that data is used, and if the company sells PI, the types of entities the PI is sold to and the purpose for the sale.

So What Does All This Mean for Your Company?

The CCPA applies to companies that do business in California and meet one or more of the following three criteria: have more than $25 million in annual gross revenue (derived from business anywhere, not just California); buy, receive, sell or share the personal information of 50,000 or more consumers or devices; or derive 50 percent or more of their annual revenue from selling consumers’ personal information.

California companies, and companies with significant online presences, are already gearing up to meet these demands. But you’re a company (or you represent a company)—based in Pennsylvania, New Jersey or Delaware—that either doesn’t do business with California consumers or has a limited number of customers from California. Why does this affect you?

The CCPA’s definition of covered business is quite broad: as currently drafted, a company with $25 million in gross international revenue but only a few sales in California is subject to the law. Most companies with online sales deal with California consumers—California is the largest economy in the United States and the fifth largest economy in the world. No physical footprint within the state is required. Therefore, even if your company has zero California customers, you might be doing business with a company covered under the CCPA. If so, you are likely to face some contract amendments.

The CCPA requires covered businesses to have certain provisions in their service provider contracts limiting the use of data, in fact prohibiting “the entity receiving the information from retaining, using or disclosing the personal information for any purpose other than for the specific purpose of performing the services specified in the contract for the business.” In addition, depending on the nature of your agreement and the services provided, a company covered under the CCPA may need to alter your contract to ensure that you will assist them in complying with consumer requests for access to, or deletion of PI. They may also request revisions to ensure compliance with consumer opt-out of sale requests. As described above, the broad definitions of PI and sale under the CCPA could make compliance with opt-out problematic. So, if you have contracts with U.S. companies that have more than $25 million in gross annual revenue, it may be prudent to review your contracts now so that you can be prepared to negotiate when your counterparties come calling.

The CCPA provides businesses with a limited time period to comply with consumer requests for access, deletion or to opt-out of the sale of their data. Such requests must be completed within 45 days (although the CCPA does allow for an additional 45-day extension if a response stating a valid reason the request cannot be completed in the allotted time is provided within the first 45 days). Notably, upon receiving a deletion request, the covered business must also “direct any service providers to delete the consumer’s personal information from their records.” This means that, if your business has received PI from a covered business, you need to be prepared to delete that information too—and do it quickly.

This is no easy task given the broad definition of PI. This information includes (but is not limited to) names, email addresses, physical addresses, bank account numbers, employment information, physical characteristics, purchase records, familial status, biometric data and educational information. Accordingly, while the CCPA does not specifically require companies to complete a data inventory, maintaining and understanding your company’s data (e.g., applications, business processes, and data sharing) may be a practical requirement to comply with the CCPA. Many companies that are directly subject to the CCPA are currently involved in these types of data mapping projects. Do you need to undergo the same process to meet your obligations to your California business partners?

Finally, copycats are coming. Since the CCPA was passed less than a year ago, Hawaii (SB 418), Maryland (SB 613), Massachusetts (SD 341), New Mexico (SB 176) and Rhode Island (S 0234) have advanced privacy bills that largely track the CCPA. In March, the Washington state Senate passed a similar data privacy bill, although that legislation is modeled more on the European Union’s General Data Protection Regulation (GDPR), which provides many of the same rights, but also the right to correct collected personal data. It does not take a crystal ball (or a data privacy specialist) to recognize the trend toward additional consumer data privacy protections at the U.S. state level. In fact, a similar bill was introduced in New Jersey (A4902) in January. That bill is currently in committee.

Moreover, a federal privacy law may not be too far behind. In February both the House Subcommittee on Consumer Protection and Commerce, and the Senate Committee on Commerce, Science, and Transportation held hearings to explore the potential passage of a national privacy law. On April 9 and 10, the FTC has scheduled hearings on the FTC’s approach to consumer privacy as part of their Hearings on Competition and Consumer Protection in the 21^st Century. Although no bipartisan solution has been reached, the federal government is paying close attention to these issues. So even if you are not in California (or Hawaii, Maryland, Massachusetts, New Mexico, Rhode Island or Washington), a data privacy law that affects your business will be here before you know it.

Is your business ready?

 

Samuel Cullari is Philadelphia-based counsel in Reed Smith’s intellectual property, tech and data group, focusing on the intersection of technology, privacy and data security. Alexis Cocco is a Philadelphia-based senior associate in the firm's intellectual property, tech and data group, focusing on data privacy defense litigation and compliance.