As we have previously blogged, the California Consumer Protection Act ("CCPA") will impose significant new obligations on how businesses handle California State residents' personal information. Although the CCPA is scheduled to go into effect on January 1, 2020, California lawmakers are still working on amendments, implementing regulations, and clarifying CCPA exceptions. Shortly before the close of the California legislative session on September 13, 2019, several amendments were passed and sent to the Governor for signature. One of the amendments being considered by the Governor, AB 874, would modify the definition of personal information by expanding the CCPA exception for publicly available information.
How Does AB 874 Amend the CCPA?
Current Definition of Personal Information
As currently written, the CCPA defines personal information to mean information that "identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."
There is a carve-out for publicly available information, which is not considered personal information for purposes of the CCPA. Publicly available information is defined to mean information that is lawfully made available from federal, state, or local government records. At present, there are three provisions that limit the scope of publicly available information. Data is not considered publicly available information under the CCPA if it:
- is biometric information collected by a business without a consumer's knowledge;
- is deidentified or aggregate consumer information; or
- "is used for a purpose that is not compatible with the purpose for which the data is maintained and made available in the government records or for which it is publicly maintained."
The Proposed CCPA Exception Amendment
If enacted, AB 874 would amend Section 1791.140(o)(2) of the California Civil Code to remove the provision relating to whether the data is used for a purpose that was "not compatible" with the purpose for which it was made available by the government. It would also remove the provision relating to deidentified or aggregate consumer information. In so doing, deidentified or aggregate consumer information would not constitute personal information, period. By removing these two provisions from the current version of the CCPA, the amendment would leave only one limitation on the scope of publicly available information: consumer biometric data collected by a business without the consumer's knowledge. For the many businesses that rely on public records, this proposed CCPA exception amendment could significantly reduce their CCPA compliance burden.
In addition, the bill makes one minor change to the definition of personal information, which now means information that "is reasonably capable of being associated" with a particular consumer or household, as opposed to "capable" of being associated.
In sum, the bill would narrow the definition of "personal information" by expanding the scope of the "publicly available information" exemption so that any information that is lawfully made available from governmental records would be considered "publicly available" and not "personal information," regardless of how that information is used.
CCPA compliance will be vital for most businesses. Even though the law will go into effect on January 1, 2020, CCPA exceptions and amendments (including AB 874) are still being considered. In addition, businesses are waiting on additional guidance from the California Attorney General, which should be released sometime this fall. Given the breadth of what CCPA compliance entails, it is important for businesses to be prepared.
Similar Blog Posts:
CCPA Compliance: Service Provider Agreements and the California Consumer Privacy Act (CCPA)
Privacy Policies and the California Consumer Privacy Act (CCPA)
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
