Untitled California Attorney General Opinion ( 2022 )

TO BE PUBLISHED IN THE OFFICIAL REPORTS
OFFICE OF THE ATTORNEY GENERAL
State of California
ROB BONTA
Attorney General
__________
:
OPINION : No. 20-303
:
of : March 10, 2022
:
ROB BONTA :
Attorney General :
:
SUSAN DUNCAN LEE :
Deputy Attorney General :
THE HONORABLE KEVIN KILEY, ASSEMBLYMEMBER, has requested an
opinion on a question of law arising under the California Consumer Privacy Act of 2018.
QUESTION PRESENTED AND CONCLUSION
Under the California Consumer Privacy Act, does a consumer’s right to know the
specific pieces of personal information that a business has collected about that consumer
apply to internally generated inferences the business holds about the consumer from
either internal or external information sources?
Yes, under the California Consumer Privacy Act, a consumer has the right to
know internally generated inferences about that consumer, unless a business can
demonstrate that a statutory exception to the Act applies.
BACKGROUND
The California Consumer Privacy Act of 2018 (Civil Code, §§ 1798.100 et seq.) is
the first law of its kind in the nation. 1 It allows consumers in California the ability to find
1
As of this writing, a number of other states have passed or are considering similar
legislation. (See Scott, Consumer Privacy Protection Continues to Be a Key Issue for
State Lawmakers (April 2021) vol. 27, No. 7, HR Compliance Law Bull. 1.)
1
20-303
out what information a covered business is holding about them, and to opt out of certain
transfers and sales of their personal information.
The question before us asks for clarification of one of the provisions in the CCPA,
having to do with the consumer’s right to request and receive specific pieces of
information collected about them. 2 Before we proceed with a detailed analysis of the
question, however, we will take a moment to introduce the general contours of this
statutory scheme. 3
How the CCPA Came To Be
Information privacy law has been developing for decades in the United States,
along with the development of internet commerce. In 1998, the Federal Trade
Commission published a report titled “Privacy Online: A Report to Congress,” which
noted that “[g]overnment studies in the United States and abroad recognize certain core
principles of fair information practice, widely accepted as essential to ensuring fair
collection, use, and sharing of personal information in a manner consistent with consumer
privacy interests.” 4 Those core principles are:
• Consumers should have notice of an entity’s information practices.
• Consumers should have choices about how their information is used.
• Consumers should have access to the information about them that an entity
holds.
• An entity should take appropriate steps to ensure the security of the
information it holds.
• Fair information-practice rules should incorporate enforcement mechanisms to
ensure compliance with core principles.
2
Civ. Code, § 1798.110, subd. (a).
3
We note that the CCPA includes a provision allowing a business to “seek the opinion of
the Attorney General for guidance on how to comply” with the statute. (Civ. Code,
§ 1798.155.) This Opinion is not given pursuant to that statute. This Opinion is given
under the Attorney General’s traditional authority to give opinions on questions of law to
specified public officials upon their request. (Gov. Code, § 12519.)
4
Federal Trade Com., Privacy Online: A Report to Congress (June 1998) at p. 2.
2
20-303
• With respect to children’s information, parental controls should be required. 5
For the next 20 years, information privacy law developed largely on a sector-by-
sector basis, with federal statutory schemes designed to regulate the information practices
of entities holding large amounts of sensitive consumer information. Well-known
examples of such programs include the Health Insurance Portability and Accountability
Act, governing information practices of health care providers and insurers; 6 the Gramm-
Leach-Bliley Act, governing information practices of financial institutions; 7 and the
Children’s Online Privacy Protection Act, governing the use of information collected
from children under 13. 8 Despite these statutory schemes, more than eight in ten adults
in the United States feel they have little or no control over the information collected
about them online, according to a 2019 poll by the Pew Research Center. 9
Starting in 2014, a British political consulting firm called Cambridge Analytica
(now defunct) surreptitiously obtained personal information about roughly 87 million
Facebook users. 10 Cambridge Analytica then used the information to send targeted
political messages during the 2016 presidential campaign. 11 When Cambridge
Analytica’s conduct began receiving significant press coverage in 2018, 12 there arose a
public perception that the time had come to give consumers greater control over the
5
Id. at pp. 7-11.
6
42 U.S.C. §§ 1320d; 45 CFR §§ 160, 162, 164.
7
15 U.S.C. §§ 6801-6809.
8
15 U.S.C. §§ 6501-6506.
9
Auxier and Rainie, Key Takeaways on Americans’ Views about Privacy, Surveillance,
and Data-Sharing (Nov. 15, 2019), https://www.pewresearch.org/fact-
tank/2019/11/15/key-takeaways-on-americans-views-about-privacy-surveillance-and-
data-sharing/.
10
See In re: Facebook, Inc. Consumer Privacy User Profile Litigation (N.D. Cal. 2019)
402 F.Supp.3d 767, 776-778.
11
See Stats. 2018, ch. 55, § 2(f)-(h) (CCPA legislative findings and declarations).
12
See, e.g., Meredith, Facebook-Cambridge Analytica: A Timeline of the Data Hijacking
Scandal, N.Y. Times (Apr. 10, 2018); Confessore, Cambridge Analytica and Facebook:
The Scandal and the Fallout So Far, N.Y. Times (Apr. 4, 2018); McKenzie, Facebook’s
Mark Zuckerberg Says Sorry in Full-Page Newspaper Ads, N.Y. Times (Mar. 25, 2018).
3
20-303
privacy of their personal information. 13 In this environment, and hard on the heels of the
European Union’s adoption of a privacy-protective general regulation, 14 advocates in
California proposed a comprehensive consumer-privacy ballot measure for the November
2018 ballot. 15 After the proposal gathered momentum, as well as enough signatures to
qualify for the ballot, the California Legislature stepped in, proposing legislative action to
take the place of the citizens’ initiative. 16 The resulting bill became the CCPA. 17 A
series of amendments to the statute were adopted late in 2018. 18
Subsequently, in November 2020, voters approved the Consumer Privacy Rights
Act of 2020, amending and building on the CCPA. 19 The CPRA will become fully
operative on January 1, 2023. 20 None of the amendments to the CCPA introduced by the
CPRA changes the conclusions presented in this opinion.
13
Stats. 2018, ch. 55, § 2(g) (Legislative findings and declarations in support of CCPA
citing Cambridge Analytica event as factor motivating consumer desire for better privacy
controls). See also Auxier and Rainie, Key Takeaways on Americans’ Views about
Privacy, Surveillance, and Data-Sharing (Nov. 15, 2019),
https://www.pewresearch.org/fact-tank/2019/11/15/key-takeaways-on-americans-views-
about-privacy-surveillance-and-data-sharing/ (three-quarters of U.S. adults said there
should be more government regulation of online data than there is).
14
General Data Protection Regulation, EU 2016/679, https://gdpr-info.eu/ (as of Mar. 9,
2022). The GDPR took effect May 25, 2018 in all European Union member states.
Under the GDPR, covered European consumers have various rights over the use of their
personal data, including rights to know, to access, to restrict processing, to object, to
rectification, to erasure, to data portability, and rights related to automatic decision
making. See generally General Data Protection Regulation, ch. 3, https://gdpr-
info.eu/chapter-3/ (as of Mar. 9, 2022).
15
See California Secretary of State, Proposed Initiative Enters Circulation: Establishes
New Consumer Privacy Rights; Expands Liability for Consumer Data Breaches:
Initiative Statute (Dec. 18, 2017), https://www.sos.ca.gov/administration/news-releases-
and-advisories/2017-news-releases-and-advisories/proposed-initiative-enters-
circulation39.
16
Sen. Jud. Com., analysis of Assem. Bill No. 375 (2017-2018 Reg. Sess.), as amended
Jun. 25, 2018, pp. 2-3.
17
Assem. Bill No. 375 (2017-2018 Reg. Sess.) (enacted Stats. 2018, ch. 55).
18
See Stats. 2018, chs. 735, 748, 751, 757, 759, 763.
19
Initiative Measure (Prop. 24) approved Nov. 4, 2020, eff. Dec. 16, 2020.
20
Id. at § 31.
4
20-303
Relevant Provisions of the CCPA
The CCPA applies to businesses that collect information from consumers in
California and that either: have gross revenues exceeding $25 million a year; buy,
receive, or share for commercial purposes the information of 50,000 or more people a
year; or derive 50 percent or more of their annual revenue from selling consumers’
personal information. 21 The CCPA defines “personal information” as including
“information that identifies, relates to, describes, is reasonably capable of being
associated with, or could reasonably be linked, directly or indirectly, with a particular
consumer or household.” 22 The definition exempts information that is “deidentified,” as
well as “aggregate consumer information,” 23 thus creating a powerful incentive for
businesses to store information in forms that reduce the risk of exposing individual
consumers’ personal information.
The definition of “personal information” is broad, specifically including personal
identifiers (such as name, date of birth, Social Security number), as well as information
about education, employment, travel, health, credit, banking, Internet Protocol addresses,
online transactions, online searches, biometric data, or geolocation data. 24 Most relevant
to our present purposes, the definition also includes “inferences drawn from any of the
information identified in this subdivision to create a profile about a consumer reflecting
the consumer’s preferences, characteristics, psychological trends, predispositions,
behavior, attitudes, intelligence, abilities, and aptitudes.” 25
The CCPA endows California residents with new rights of control over the
personal information that covered businesses hold about them. California consumers
now have:
• The right to know what personal information a business collects about them,
and how the business uses and shares that information. 26
21
Civ. Code, § 1798.140, subd. (c)(1)(A)-(C).
22
Civ. Code, § 1798.140, subd. (o)(1).
23
Civ. Code, § 1798.140, subd. (o)(3).
24
Civ. Code, § 1798.140, subd. (o).
25
Civ. Code, § 1798.140, subd. (o)(1).
26
Civ. Code, §§ 1798.100, subd. (a), 1798.115, 1798.140, subd. (t)(1).
5
20-303
• The right to delete the personal information that a business collects from them
(with specified exceptions for operational and legal necessity). 27
• The right to opt out of the sale of their personal information. 28
• The right to non-discrimination, meaning that consumers who exercise their
rights under the CCPA are entitled to receive the same service and price as
consumers who do not. 29
Businesses have corresponding duties. First, a business must provide notice of
what categories of personal information it will collect about the consumer and of the
purposes for which that information will be used. 30 This notice must be provided at or
before the point at which the business collects information from the consumer. If the
business sells personal information, then the notice at collection must include a “Do Not
Sell My Personal Information” button that allows consumers to opt out of the sale of their
personal information. 31 A business’s privacy policies must inform consumers of their
rights to know, to delete, to opt out, and not to be discriminated against. 32 Businesses
must provide fresh notices to consumers when their information practices change. 33
Businesses have a duty to respond to verifiable consumer requests within 45 to 90
days. If a business is unable to comply completely with a request, it is still obliged to
34
provide as much information as it can. For instance, if a business cannot provide specific
pieces of information to the consumer, it must provide information about the categories
of information it collects. 35 If a business cannot provide either specific or category
information to the consumer, it must refer the consumer to its privacy policy. 36
Furthermore, if a business denies a consumer’s request to know “in whole or in part,
27
Civ. Code, § 1798.105.
28
Civ. Code, § 1798.120.
29
Civ. Code, § 1798.125.
30
Civ. Code, § 1798.100, subd. (b); see §§ 1798.110, subd. (c), 1798.130, subd. (a)(5).
31
Cal. Code Regs., tit. 11, § 999.305(b)(3), (4).
32
Civ. Code, § 1798.130, subd. (a)(5).
33
Civ. Code, § 1798.100, subd. (b); Cal. Code Regs., tit. 11, § 999.305(a)(5), (6).
34
Civ. Code, § 1798.130(a)(2); see also § 1798.130, subd. (a)(3), (4) (discussing
verification of requests); Cal. Code Regs., tit. 11, §§ 999.323 – 999.325 (same).
35
Cal. Code Regs., tit. 11, § 999.313(c)(1).
36
Cal. Code Regs., tit. 11, § 999.313(c)(2).
6
20-303
because of a conflict with federal or state law, or an exception to the CCPA,” the business
must explain the basis for its denial. 37
There are a number of significant exceptions to the CCPA. First, the CCPA does
not apply to government entities or nonprofit organizations, and excludes information
that is freely available from government sources, such as vital statistics, real estate
records, and professional licenses. 38 The CCPA also contains a set of nuanced exceptions
for certain categories of information—such as medical records, credit reporting, banking,
and vehicle safety records—that apply when the information is governed by another
privacy-protecting statute. 39
Section 1798.145 also incorporates carve-out provisions designed to relieve
businesses from undue burdens and common legal binds:
(a) The obligations imposed on businesses by this title shall not restrict a
business’ ability to:
(1) Comply with federal, state, or local laws.
(2) Comply with a civil, criminal, or regulatory inquiry . . .
(3) Cooperate with law enforcement agencies . . .
(4) Exercise or defend legal claims.
(5) Collect, use, retain, sell, or disclose information that is deidentified . . .
(6) Collect or sell a consumer’s personal information if every aspect of that
conduct takes place solely outside California. . . .
Some of these provisions are relevant to our analysis of the question, below.
Regulation, Enforcement, and the Future of the CCPA
The Legislature enacted the CCPA late in 2018 and the statute became operative
January 1, 2020. 40 The delayed operative date allowed time for the business community
and privacy professionals to adjust to the new rules and for the administrative rulemaking
process to run its course. The Legislature adopted a number of amendments to the Act
before it became operative. 41
37
Cal. Code Regs., tit. 11, § 999.313(c)(4).
38
Civ. Code, § 1798.140, subd. (o).
39
Civ. Code, § 1798.145, subds. (c), (d), (e), (g).
40
Stats. 2018, c. 55 (A.B.375), § 3, eff. Jan. 1, 2019, operative Jan. 1, 2020.
41
See Westlaw, Practical Law Practice Note w-017-4166, Understanding the California
Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
7
20-303
The CCPA directed the Attorney General to adopt regulations by July 1, 2020, as
needed to address an extensive list of issues including refining definitions and
establishing procedures for businesses to verify and comply with requests. 42 Most
relevant for present purposes is the provision authorizing the Attorney General to
establish “any exceptions necessary to comply with state or federal law, including, but
not limited to, those relating to trade secrets and intellectual property rights.” 43
Throughout 2019 and well into 2020, the Department of Justice gathered and
analyzed a mass of information and public comment in preparation for proposing final
regulations. 44 The Attorney General submitted proposed regulations and supporting
materials to the Office of Administrative Law for its consideration in June 2020, and the
regulations became operative on August 14, 2020. 45 A set of amendments to the
regulations went into effect March 15, 2021. 46 The regulations do not specifically
address the question presented here.
The Attorney General’s power to enforce the CCPA took effect on July 1, 2020. 47
The Attorney General has authority to seek injunctive relief and civil penalties, with
enhanced penalties for intentional violations of the statute. 48 Consumers have a limited
private right of action under the statute for a data breach caused by a business’s failure to
use reasonable security measures, but not for any other violations of the statute. 49
The Consumer Privacy Rights Act of 2020, which was approved by voters as
Proposition 24 in November 2020, amends and builds on the CCPA. 50 The CPRA goes
into effect on January 1, 2023, and enforcement is slated to begin July 1, 2023 under the
42
See generally Civ. Code, § 1798.185.
43
Civ. Code, § 1798.185, subd. (a)(3).
44
See Rulemaking Files available at https://oag.ca.gov/privacy/ccpa/regs (as of Mar. 9,
2022).
45
Cal. Code Regs., tit. 11, § 999.300 (history); see generally Cal. Code Regs., tit. 11,
§§ 999.300-999.341.
46
Cal. Code Regs., tit. 15, §§ 999.306, 999.315, 999.326, 999.332.
47
Civ. Code, § 1798.185, subd. (c).
48
Civ. Code, § 1798.155, subd. (b).
49
Civ. Code, § 1798.150.
50
Initiative Measure (Prop. 24) approved Nov. 4, 2020.
8
20-303
newly formed California Privacy Protection Agency. 51 The CPRA will adjust the
threshold size for businesses covered by the statute, exempting more small businesses
going forward. The new law will also expand consumer privacy rights in ways generally
consistent with the European Union rules, including enhanced protection for sensitive
personal information, and a right to request corrections to inaccurate personal
information. The amendments to the CCPA introduced by the CPRA do not change the
conclusions presented in this opinion.
ANALYSIS
Introduction
Assemblymember Kiley asks whether a consumer’s right to receive the specific
pieces of personal information that a business has collected about that consumer applies
to internally generated inferences. For purposes of the CCPA, “inference” means “the
derivation of information, data, assumptions, or conclusions from facts, evidence, or
another source of information or data.” 52 An inference is essentially a characteristic
deduced about a consumer (such as “married,” “homeowner,” “online shopper,” or
“likely voter”) that is based on other information a business has collected (such as online
transactions, social network posts, or public records). Some businesses create inferences
using their own proprietary methods, and then sell or transfer the inferences to others for
commercial purposes. 53 Examples drawn from academic papers in 2018 show that
seemingly innocuous data points, when combined with other data points across masses of
data, may be exploited to deduce startlingly personal characteristics. 54 Studies show,
51
2020 Cal. Legisl. Service Prop. 24, § 31. The new agency will have rulemaking
authority under the CPRA (Civ. Code, § 1798.185, operative Jan. 1, 2023), as well as
power to enforce the CPRA through administrative actions (Civ. Code, § 1798.199.40,
subd. (a), operative Jan. 1, 2023). The Attorney General will retain authority to enforce
the statute through civil investigative and enforcement powers. (Civ. Code,
§ 1798.199.90, operative Jan. 1, 2023.)
52
Civ. Code, § 1798.140, subd. (m).
53
Beckett, Everything We Know About What Data Brokers Know About You (Jun. 13,
2014), https://www.propublica.org/article/everything-we-know-about-what-data-brokers-
know-about-you.
54
Lally, Examples of Data Points Used in Profiling (2018) available at
https://privacyinternational.org/sites/default/files/2018-
04/data%20points%20used%20in%20tracking_0.pdf (as of Mar. 9, 2022), and as an
attachment to Privacy International, A Snapshot of Corporate Profiling (Apr. 9, 2018)
(attachment labeled Data Points Used in Tracking)
https://www.privacyinternational.org/long-read/1721/snapshot-corporate-profiling.
9
20-303
among other things, that a person’s date and place of birth, in combination with public
databases, can be used to predict their social security number; phone data can be used to
predict friendships with 95 percent accuracy; data about mobile phone behavior (such as
running out of battery) can be used to predict credit-worthiness; and Facebook “likes”
can be used to predict a wide array of sensitive personal attributes such as age, gender,
race, ethnicity, sexual orientation, political views, and personality traits. 55
As discussed below, the plain language of the statute, as well as the legislative
history, persuade us that the CCPA purposefully gives consumers a right to receive
inferences, regardless of whether the inferences were generated internally by the
responding business or obtained by the responding business from another source. At the
same time, the CCPA does not require businesses to disclose their trade secrets in
response to consumers’ requests for information.
The CCPA Generally Requires Businesses to Disclose Internally Generated
Inferences to Consumers.
As always when we undertake to interpret a statute, we start by examining the text,
giving the language its usual meaning in order to understand the intent of the legislators.
The words of a statute must be construed in context and sections relating to the same
subject must be harmonized to the extent possible. 56 Here, the logical entry point to the
text is the CCPA’s definition of “personal information.” Personal information, as noted
briefly above, includes “information that identifies, relates to, describes, is reasonably
capable of being associated with, or could reasonably be linked, directly or indirectly,
with a particular consumer or household.” 57 But that is just the beginning of the
definition. The section goes on from there to add both breadth and specificity, extending
to eleven subparts. The language most relevant to our analysis directs that:
(o)(1) . . . Personal information includes, but is not limited to, the following
if it identifies, relates to, describes, is reasonably capable of being
associated with, or could be reasonably linked, directly or indirectly, with a
particular consumer or household:
[. . .]
(K) Inferences drawn from any of the information identified in this
subdivision to create a profile about a consumer reflecting the consumer’s
preferences, characteristics, psychological trends, predispositions, behavior,
attitudes, intelligence, abilities, and aptitudes.
55
See id. at pp. 5, 8-11.
56
See, e.g., Dyna-Med, Inc. v. Fair Employment & Housing Com. (1987) 43 Cal.3d 1379,
1386-1387.
57
Civ. Code, § 1798.140, subd. (o)(1).
10
20-303
This text makes the initial stage of our analysis straightforward. “Inferences” are
themselves “personal information” for purposes of the CCPA (and therefore disclosable)
when two conditions exist. First, the inference is drawn “from any of the information
identified in this subdivision.” Second, the inference is used to “create a profile about a
consumer,” or in other words to predict a salient consumer characteristic.
As to the first condition, an inference must be drawn from “information identified
in this subdivision,” that is, subdivision (o) of Civil Code section 1798.140. Subdivision
(o) identifies a vast array of information, including but not limited to:
• personal identifiers (such as names, addresses, account numbers, or
identification numbers);
• customer records;
• characteristics of protected classifications (such as age, gender, race, or
religion);
• commercial information (such as property records or purchase history);
• biometric information;
• online activity information;
• geolocation data;
• “audio, electronic, visual, thermal, olfactory, or similar information”;
• professional or employment information; education information;
• and inferences drawn from any of the above. 58
We can see that this array includes not only information typically obtained directly
from consumers (such as address and income), but also many kinds of information that
are a matter of public record (such as information on property listings and tax rolls).
Subdivision (o) draws no distinction between public and private sources. It follows that,
for purposes of responding to a request to know, it does not matter whether the business
gathered the information from the consumer, found the information in public repositories,
bought the information from a broker, inferred the information through some proprietary
process of the business’s own invention, or any combination thereof. 59 If the business
58
Civ. Code, § 1798.140, subd. (o)(1)(A)-(K).
59
Cf. Civ. Code, § 1798.140, subd. (o)(2) (“personal information” does not include
public records).
11
20-303
holds personal information about a consumer, the business must disclose it to the
consumer on request.
We emphasize that, once a business has made an inference about a consumer, the
inference becomes personal information—one more item in the bundle of information
that can be bought, sold, traded, and exploited beyond the consumer’s power of control.
Accordingly, inferences satisfy the first condition of the “personal information” inquiry
regardless of whether they have been generated internally by the responding business or
received from another source.
The second condition of a disclosable inference, that the personal information
must be used to “create a profile about a consumer,” narrows the set of inferences that
must be disclosed. It rules out situations where a business is using inferences for reasons
other than predicting, targeting, or affecting consumer behavior. For instance, a business
might combine information obtained from a consumer with online postal information to
obtain a nine-digit zip code to facilitate a delivery and completion of a particular
transaction. But if the zip code is merely deleted and not used to identify or predict the
characteristics of a consumer, in our view that would not give rise to a disclosable
inference within the meaning of the statute. On the other hand, when a business
processes personal information to make an inference about the consumer’s propensities,
then the inference itself becomes part of the consumer’s profile, and must be disclosed.
A business might draw an inference about a consumer based in whole or in part on
publicly available information, such as government identification numbers, vital records,
or tax rolls. Under the CCPA, the inference must be disclosed to the consumer, even if
the public information itself need not be disclosed in response to a request for personal
information. 60
Our reading of the text is confirmed by evidence of legislative purpose. The
Senate Judiciary Committee’s analysis of the CCPA bill spotlights the Legislature’s
concern about the exploitive tendencies of collecting masses of information and using it
to identify and affect unwitting consumers. The analysis specifically referred to the
practices of Cambridge Analytica, in which a certain app—presented to Facebook users
as a personality test—was used to gather masses of personal information. 61 The
information was then used to draw inferences about millions of individuals, including
60
Compare Civ. Code, § 1798.140, subd. (o)(1)(K) with Civ. Code, §1798.140, subd.
(o)(2).
61
See In re: Facebook, Inc. Consumer Privacy User Profile Litigation, supra, 402
F.Supp.2d at 777.
12
20-303
their political party and voting behavior, and those inferences were used to target political
advertising for the purpose of influencing the outcome of the 2016 presidential election. 62
But Cambridge Analytica is far from the only example of mischief resulting from
the creation and use of inferences by businesses. Inferences are one of the key
mechanisms by which information becomes valuable to businesses, making it possible to
target advertising and solicitations, and to find markets for goods and services. In some
cases, marketing tactics are so tailored that they feel intrusive or unsettling to
consumers. 63 In other cases, consumers may never know that they are being excluded
from seeing certain ads, offers, or listings based on discriminatory automated decisions. 64
In almost every case, the source as well as the substance of these inferences is invisible to
consumers. 65 In light of all these circumstances, inferences appear to be at the heart of
the problems that the CCPA seeks to address.
The Requestor’s letter suggests an argument that inferences need not be disclosed
to consumers because inferences are information that has been generated internally by a
business, not collected from the consumer within the meaning of Civil Code section
1798.110, subdivision (a). That subdivision states: “A consumer shall have the right to
request that a business that collects personal information about the consumer disclose to
the consumer . . . [t]he specific pieces of personal information it has collected about that
consumer.” We disagree with that argument.
Tellingly, the CCPA gives consumers the right to receive all information collected
“about” the consumer, not just information collected from the consumer. 66 When a
business creates (or buys or otherwise collects) inferences about a consumer, those
inferences constitute a part of the consumer’s unique identity and become part of the
body of information that the business has “collected about” the consumer. Thus, in light
of the plain meaning of section 1798.140, subdivision (o), inferences must be disclosed to
the consumer upon request.
62
Ibid.
63
See Bill Analysis, Sen. Com. On Jud., AB 375 (2017-2018 Reg. Sess.), as amended
June 25, 2018, pp. 1-2, 16.
64
See Lally, supra, at pp. 28-39.
65
Inferences can be especially painful for consumers who are tagged with incorrect or
outdated inferences of a sensitive nature, such as pregnancy or substance addiction.
66
Civil Code, § 1798, subd. (a)(5) (“A consumer shall have the right to request that a
business that collects personal information about the consumer disclose to the consumer .
. . [t]he specific pieces of personal information it has collected about that consumer.”)
13
20-303
The CCPA Does Not Require Businesses to Disclose their Trade Secrets
The opinion request also suggests that internally generated inferences may
constitute a business’s intellectual property. A similar concern came up repeatedly
during the rulemaking process, with commenters suggesting that disclosure of internally
generated inferences could reveal trade secrets. 67 But the Attorney General was not
presented with any concrete examples of situations where inferences are themselves trade
secrets, or where the disclosure of inferences would expose a business’s trade secrets.
While the algorithm that a company uses to derive its inferences might be a protected
trade secret, the CCPA only requires a business to disclose individualized products of its
secret algorithm, not the algorithm itself.
It is beyond the scope of this opinion to address whether any particular kind or
class of internally generated inference might be protected from disclosure because it
constitutes a trade secret. Under California’s Uniform Trade Secrets Act, 68 a trade secret
is essentially information that derives independent economic value from not being
generally known to the public or others who can obtain economic value from its use or
disclosure, and as to which the owner exerts reasonable efforts to maintain secrecy. 69 In
order to show the existence of a trade secret, an owner must identify the secret with
“reasonable particularity.” 70 The Act permits a person to sue for injunctive relief and
damages when their protected trade secrets are obtained by “improper means.” Under the
Act, the burden is on the trade secret holder to prove both the existence of a trade secret,
and somebody’s use of improper means to obtain it. 71 “Improper means” does not
include reverse engineering. 72
While we cannot answer fact-specific questions about whether particular inferences
could be protected as trade secret, we can answer the general legal question whether the
CCPA requires businesses to disclose trade secrets: It does not. We believe the most
relevant language is this: “The obligations imposed on businesses by this title shall not
restrict a business’ ability to: Comply with federal, state, or local laws.” 73 The CPRA
67
Records of official rulemaking are available at https://oag.ca.gov/privacy/ccpa/regs (as
of Mar. 9, 2022).
68
See Civ. Code, § 3426.1, subd. (d).
69
Civ. Code, § 3426.1, subd. (b).
70
Code Civ. Proc., § 2019.210 (pleading requirement for trade secret claim).
71
See Civ. Code, § 3426.1.
72
Civ. Code, § 3426.1, subd. (a).
73
Civ. Code, § 1798.145, subd. (a)(1). To date the Attorney General has not found it
necessary to promulgate regulations specifically related to intellectual property.
14
20-303
amends the scope of the Attorney General’s rulemaking slightly, to include “any
exceptions necessary to comply with state or federal law, including those relating to
trade secrets and intellectual property rights . . . with the intention that trade secrets
should not be disclosed in response to a verifiable consumer request.” 74
California law protects intellectual property, including trade secrets, as
demonstrated by its adoption of the Uniform Trade Secrets Act. The text of both the
CCPA and the CPRA contain language indicating an intent to protect intellectual
property. When a trade secret exists, the CCPA will not require its disclosure to a
consumer. However, a business that denies a request “in whole or in part, because of a
conflict with federal or state law, or an exception to the CCPA” must explain the nature
of the information and the basis for its denial. 75 A blanket assertion of “trade secret” or
“proprietary information” or the like would not suffice; the general import of the
regulations is that a business must respond to requests in a meaningful and
understandable way. 76
In sum, we conclude that internally generated inferences that a business holds
about a consumer are personal information within the meaning of the CCPA, and must be
disclosed to the consumer on request. A business that withholds inferences on the ground
that they are protected trade secrets bears the ultimate burden of demonstrating that such
inferences are indeed trade secrets under the applicable law.
74
Civ. Code, § 1798.185, subd. (d)(3) (emphasis added), as amended by Initiative
Measure Prop. 24, § 21, approved Nov. 3, 2020, eff. Dec. 16, 2020, operative Jan. 1,
2023.
75
Cal. Code Regs., tit. 11, § 999.313(c)(5).
76
See generally Cal. Code Regs., tit. 11, §§ 999.305(a)(2) (disclosures must be easy to
read and understandable to consumer), 999.306(a)(2) (same), 999.307(a)(2) (same),
999.308(a)(2) (same).
15
20-303