After more than a year of preparation, the California Consumer Privacy Act is now in effect. Yet, in the sprint to get ready for the CCPA, businesses may have overlooked the CCPA’s impact on anticipated or pending civil litigation. This article examines some of those impacts.
Deletion of personal information pre-litigation
Readers are undoubtedly aware of the general rule that the obligation to preserve evidence arises when [a] party has notice that the evidence is relevant to litigation or when a party should have known that the evidence may be relevant to future litigation. The failure to adhere to this obligation can have serious ramifications. If a court finds that a business failed to preserve relevant evidence, it can levy a wide array of sanctions on the business. And yet, the CCPA requires companies to delete consumer information under a number of circumstances. While there are exceptions to the obligation to delete, those exceptions are not as express as many potential litigants might prefer.
While the CCPA authorizes individuals to request that a business delete their information, the CCPA exempts a business from complying with a deletion request when necessary for the business to [c]omply with a legal obligation. Neither the CCPA nor the accompanying regulations proposed by the California attorney general spell out when a legal obligation is sufficiently concrete such that a business can deny a consumer’s deletion request.
When a duty to preserve arises, it is often a subjective determination, one made between a client and their counsel as they navigate the line between business negotiations and business dispute. Most businesses take a conservative approach to their duty to preserve, placing legal holds at a nascent stage of a potential dispute.
But what if that decision were to be challenged under the CCPA?
What the CCPA may permit the California attorney general to do is question whether a business’s decision to preserve documents at a given point of time was justified when compared against a consumer deletion request. As a result of the vagaries of the CCPA and its proposed regulations, businesses are left to hope their decisions to preserve are not second-guessed by the attorney general.
Another potential issue arising from the intersection of the CCPA and a duty to preserve is knowing when that duty covers a particular individual’s consumer data. For example, if John Doe were to request his information be deleted from XYZ Corporation, how is XYZ to know whether that particular data is subject to a litigation hold? Litigation holds are necessarily broad in nature, e.g., “all documents related to ABC transaction.” Out of a business necessity to continue with ongoing operations, companies do not frequently take the additional step of segregating data that is subject to a litigation hold from its normal environment. And so, under the CCPA, businesses face the very real challenge of not only identifying all the personal data to which a deletion request applies, but also of training their employees to research whether that particular data is subject to one — or possibly dozens — of litigation holds. It is entirely possible some companies may almost never be able to delete consumer data in response to a CCPA deletion request because the information is subject to a litigation hold — that is, assuming an obligation to preserve rises to a “legal obligation” under the CCPA in the first instance.
Disclosure of personal information pre-litigation
Imagine a world in which plaintiffs’ attorneys can obtain pre-litigation class discovery. Welcome to the CCPA. Anyone who has been involved in class-actions knows that some of the most sought-after discovery is information about potential class members. Now, the CCPA has given attorneys a front door to obtaining at least some of that discovery.
Generally speaking, under the CCPA, individuals have the right to request access to the information a business has regarding that consumer. Moreover, the CCPA permits individuals to authorize agents to make those requests. Thus, using a power of attorney from 100 or even 10,000 California residents, attorneys may be able to make mass information requests to companies. An attorney may, therefore, be able to leverage individuals’ CCPA rights to benefit the attorney’s pre-litigation preparation for a class-action. Using the data obtained through a CCPA request, the attorney can perform diligence on a prospective named plaintiff, determine approximate class size and obtain insight into the business practices of a company months before any lawsuit is filed.
It is not hard to imagine the CCPA could become weaponized against businesses moving forward. Obviously, this type of process was not what was envisioned when the CCPA was drafted and certainly does not advance consumer privacy rights. The CCPA does allow businesses to “charge a reasonable fee” if consumer requests are “manifestly unfounded or excessive,” but with millions of dollars at stake in larger consumer class-actions, it is unlikely a “reasonable fee” would deter a well-funded attorney. One potential method through which a business can refuse these weaponized CCPA requests would be to refuse to provide access to information that is clearly part of a mining activity. The CCPA does not restrict a business’s ability to “exercise or defend legal claims.” Businesses could potentially refuse to comply with a mass-access request by asserting that right. Whether a business can refuse an access request clearly aimed at pre-litigation discovery is an issue ripe for a request for guidance from the attorney general.
The CCPA thus puts pre-litigation pressure on businesses from at least two directions. First, the CCPA’s deletion requirements may complicate a business’s decision to retain data in advance of litigation. Second, the CCPA’s disclosure requirements may require businesses to produce information about potential class members pre-litigation.
Document collection and production
Businesses will also have to factor in obligations under the CCPA when complying with their litigation discovery obligations. The good news for businesses is the CCPA expressly permits them to use personal information as necessary to “[e]xercise or defend legal claims.” Thus, the CCPA permits document collection and production in litigation. However, the CCPA doesn’t stop there, and that’s where the trouble starts.
It’s common in large civil litigations for companies to provide to their lawyers and for their lawyers to produce to litigation opponents, large volumes of e-mail, database information and the dreaded massive Excel spreadsheet. All that information could — and, in many instances, likely does — include consumer information that would be covered by the CCPA. This is potentially problematic because the CCPA requires businesses to track with which categories of third parties personal consumer data has been shared. This means businesses could be required to maintain an inventory of what consumer information is collected and produced in civil litigation. For many companies and law firms, this will require an extra level of administration. And, in reality, this obligation may simply be untenable. How is a company to know whether a random California consumer’s information is in one email out of a terabyte of data? The obligation under the CCPA to track third-party disclosures is practically impossible in a litigation setting.
This reality is particularly troubling given consumer advocacy groups are pushing for amendments to the CCPA that would require not just the disclosure of categories of third parties to whom information has been shared, but also disclosure of the exact identity of the third parties with whom information is shared. As a practical matter, that type of disclosure in a litigation setting would be virtually impossible, imposing on businesses an untenable and unworkable situation.
This article aims to highlight some of the potential hurdles the CCPA creates for litigants in an effort to call attention to issues we believe require further legislative and/or regulatory attention to avoid creating what appear to be unrealistic and impractical expectations of litigants.
