Opinion No. 20-303

The California Consumer Privacy Act (“CCPA”) is the most expansive set of privacy laws to date in the United States and provides California residents with varied controls regarding the personal information retained by businesses that are within the confines of the CCPA.  These rights include: the right to know what personal information a business collects about them, as well as how the business uses and shares the information; the right to opt out of the sale of their personal information; the right to non-discrimination for opting to exercise consumer rights under the CCPA; and the right to delete personal information that a business collects.

In Opinion No. 20-303, Assemblymember Kevin Kiley posed a question to the California Attorney General’s office (California AG), as to whether a consumer’s right to know, as granted under the CCPA, applies to internally generated references that a business holds about the consumer from internal or external information sources.  For the purposes of the CCPA, an inference is “the derivation of information, data, assumptions, or conclusions from facts, evidence, or another source of information or data.”  Seemingly simple data about a consumer can lead to powerful inferences, such as whether a consumer is a homeowner, a voter, or married.

In analyzing whether a consumer’s right to know extends to inferences, the California AG examined the plain language of the text of the CCPA.  Based on the reach of “personal information” as discussed in the CCPA, the California AG interprets this as including inferences when two conditions exist: the inference is drawn from any of the information identified in the subdivision; and the inference is used to create a profile about a consumer.  Notably, the Opinion of the California AG states that once a business has made an inference about a consumer, the inference becomes personal information that can be used beyond what the consumer may intend or expect.

The legislative intent of the CCPA was also considered when determining whether inferences fall within a consumer’s “right to know.”  The Senate Judiciary Committee’s analysis of the bill contemplating the CCPA focused on the dangers of business collecting swaths of information from consumers without providing sufficient knowledge to the consumers about the uses of this information.

However, the Opinion notes that the CCPA does not require that businesses disclose their trade secrets.  The language of the CCPA reveals that intellectual property is protected.  When a trade secret exists, the CCPA will not require that it be disclosed to a consumer, although the business must explain the nature of the information and the basis for a denial of a request due to a conflict with federal or state law, or an exception to the CCPA.

The conclusion of the Opinion provides that the consumer does have a right to know internally generated inferences about that consumer, unless a business is able to show that an exception to the CCPA applies.

What Should My Company Do?

It is more important than ever for businesses to become well-acquainted with the CCPA and the California Privacy Rights Act (“CPRA”).  Businesses should ensure that they are undergoing the proper protocols with respect to consumers’ personal information and are compliant with both the CCPA and CPRA if they are subject to its requirements.  The CCPA is currently in effect and the CPRA will officially go into effect on January 1, 2023, with a 12-month lookback period that commenced on January 1, 2022.

How Newmeyer Dillion Can Help

Newmeyer Dillion can assist with achieving full compliance with the CCPA and CPRA.  Our attorneys are available for consultation by contacting our office at 949-854-7000.