CCPA: Privacy Notices & Access Requests
Friday, January 29, 2021

So, My Privacy Notice Does Not Fully Comply with the CCPA. Can I Get Sued?

The CCPA permits consumers to “institute a civil action” only where certain types of personal information are “subject to an unauthorized access and exfiltration, theft, or disclosure.”1 The CCPA does not provide a private right of action, nor does it provide statutory damages, if a business violates its obligation to provide notice concerning its privacy practices.2

The California Unfair Competition Law (UCL) defines “unfair competition” as including “any unlawful, unfair, or fraudulent business act or practice.”3 Plaintiffs’ attorneys in California have historically attempted to use the UCL to bring suit against companies that allegedly violated any other California or federal law by arguing that the secondary violation constituted an “unlawful” practice for which the UCL might permit recovery. However, such a strategy may not succeed in connection with the CCPA, as the Act expressly states that “[n]othing in this title shall be interpreted to serve as the basis for a private right of action under any other law.”4

An amendment to the CCPA – Senate Bill 561 – was proposed which, had it passed, would have extended the private right of action to all alleged violations of the CCPA. While the amendment received the endorsement of the California Attorney General, on May 16, 2019, it was held in committee under submission pending fiscal review. As of the date of this post the amendment had not been enacted. During the rulemaking process the California Attorney General was separately requested to “[i]nclude a private right of action in the regulations” to the CCPA. The Attorney General declined, stating that he lacked the authority to “implement regulations that alter or amend a statute” and specifically noted that “the Legislature declined to pass SB 561.”5


So, There Are ‘Access Requests’ and ‘Requests to Know’: What Is the Difference?

The CPRA, which modified the CCPA, uses the term “right to know” and “right to access” synonymously.6 The regulations implementing the CCPA use the phrase “request to know” exclusively. Most data privacy attorneys use the term “access rights” and requests for such information as “access requests,” as those terms have historically been used within the data privacy community and align terminology with other legal regimes (e.g., the European GDPR).


What Is a ‘Category-level Access Request,’ and Do I Have to Respond to It?

The CCPA and its implementing regulations identify six types of information requests that a consumer can submit to a business. As the first five requests ask that a business respond with broad information about the type of information collected (as opposed to the actual information itself), they are often referred to as category-level access requests. As the sixth request asks that a business respond with the actual information that the business collected about a consumer, it is often referred to as a specific-information request.

So, for example, if a consumer submitted a category-level request that asked a business what categories of personal information the business collected about the consumer, it might be sufficient for the business to respond by stating that it collected “identifiers” about the consumer, or it could respond more specifically by stating that it collected the consumer’s name and email address. If the same consumer submitted a specific information request to the same business, the business might respond by telling the consumer that it collected the name “John Smith” and the email address John.Smith@acme.com.7


1  Cal. Civ. Code 1798.150(a)(1).
2  Cal. Civ. Code 1798.110(c); 1798.115(c); 1798.130(a)(5). Note, however, that the CCPA does permit the California Attorney General to pursue civil penalties.
3  Cal. Bus. & Prof. Code 17200.
4  Cal. Civ. Code 1798.150(c).
5  FSOR Appendix A at 310 (Response 920).

6 Cal. Civ. Code 1798.110.

7 See FSOR Appendix A at 121 (Response 392).

 

NLR Logo

We collaborate with the world's leading lawyers to deliver news tailored for you. Sign Up to receive our free e-Newsbulletins

 

Sign Up for e-NewsBulletins