Data & Privacy Law

CCPA Forms: The Right to Opt-Out, Request to Know and Request to Delete

February 28, 2020 by David Klein

Readers of this blog have been following our coverage of the California Consumer Privacy Act (“CCPA”) and related regulatory developments. In today’s blog, we detail some of the compliance measures that should be taken with respect to consumer data election rights and the associated CCPA forms through which consumers can make these elections. Among other measures, the CCPA has codified California consumers’ rights to: 1) opt-out of the sale of their personal information to third parties; 2) request to know what personal information businesses have collected about them and how businesses have sold or disclosed that information to third parties; and 3) request that businesses delete personal information that has been collected from/about them. With limited exceptions, businesses should provide consumers with CCPA forms to make elections by and through their websites.

What are CCPA forms and when should they be processed?

CCPA Forms

In order to comply with the CCPA, each business is required to “provide two or more methods for submitting requests to opt-out, including, an interactive form accessible via a clear and conspicuous link titled ‘Do Not Sell My Personal Information,’ or ‘Do Not Sell My Info,’ on the business’ website or mobile application.” Businesses do not need to provide an opt-out form if they do not sell personal information and explain this fact in their privacy policies. Opt-out forms should: 1) include a description of consumers’ rights to opt-out of the sale of their personal information; 2) use plain, straightforward language and avoid technical or legal jargon; 3) provide instructions on any other method by which consumers may submit their requests to opt-out; and 4) be reasonably accessible to consumers with disabilities. The modified CCPA regulations have removed the requirements that opt-out forms include proof when consumers are using authorized agents to exercise their rights to opt-out and that opt-out forms provide links to the URLs of businesses’ privacy policies.

The most recent proposed CCPA regulation revisions have eliminated the requirement that businesses operating exclusively online that have a direct relationship with their consumers provide a web-based CCPA form to submit right to know requests. These businesses are now only required to provide an email address. All other businesses must provide two (2) methods for submitting requests to know including, but not limited to, a toll-free telephone number and, a designated email address or a form that can be submitted by U.S. Mail. When supplying consumers with the ability to delete their personal information, businesses must provide two (2) or more methods for submitting these requests. Methods include, but are not limited to, a toll-free number, a link or form available online through a business’s website, or a designated email address. If businesses create CCPA forms to satisfy right to know and deletion election requirements, they too should use plain, straight forward language, which must be reasonably accessible to consumers with disabilities. Please note that the modified CCPA regulations no longer require a two-step process to effectuate online requests to delete.

Processing CCPA Forms

Businesses must comply with requests to opt-out no later than fifteen (15) business days from the date the requests are received. If a business sells a consumer’s personal information after the request to opt-out has been received, but before that business has complied with the request, it must notify third parties that have received consumer personal information from the company in this interim period that the consumer has elected to opt-out and that these third parties may no longer sell that consumer’s personal information. Businesses must confirm receipt of right to know and deletion requests within ten (10) business days of receiving such requests and respond to these requests within forty-five (45) calendar days from the date that the subject requests were received. If necessary, businesses that are unable to respond to requests within the forty-five (45) calendar day period may take an additional forty-five (45) calendar days to respond, provided that they provide consumers with notice and explanation that an extension is required.

CCPA forms are just one regulatory implementation measure that should be taken on the path to CCPA compliance. If you are interested in learning more about this topic or require assistance with consumer data privacy compliance for your business, please email us at info@kleinmoynihan.com, or call us at (646) 713-1684.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Related Blog Posts

CCPA Law: The Private Right of Action

CCPA Service Provider Requirements Clarified by California AG

CCPA Amended to Require California Data Broker Registration

Consumer Privacy Compliance Primer

February 27, 2020 by David Klein

As readers of this blog know, businesses face significant liability if they fail to take their consumer privacy obligations seriously. These obligations can vary widely based on the kind of information a business collects and where a consumer is located. Privacy compliance is an essential consideration for many businesses, and properly obtaining consumer consent to collect, use and/or share consumer data is critical.

How Should Businesses Obtain Consumer Consent?

Existing Privacy Frameworks

The global trend toward increased consumer privacy protections continues, and jurisdictions across the world are developing new laws and updating existing frameworks to regulate the collection, use and sharing of consumer data. California and the European Union (“EU”) are unquestionably leading the pack on this front. On May 25, 2018, the General Data Protection Regulation (“GDPR”) went into effect in the EU. To date, the United States has not passed comprehensive federal privacy regulations, but privacy legislation has been proposed or enacted in several states. Most notably, on January 1, 2020, the California Consumer Privacy Act (“CCPA”) went into effect. Both the GDPR and CCPA significantly changed businesses’ obligations regarding consumer data.

When it comes to consumer consent, the GDPR can generally be described as an opt-in regime. The GDPR requires that consent be “freely given, specific, informed and unambiguous.” For US-based businesses, the GDPR may be of limited application, as it generally only applies to businesses that collect, retain or use the personal data of EU residents. By contrast, virtually all US-based businesses must carefully analyze (and most likely, implement) the CCPA’s various requirements. The CCPA imposes an opt-out regime on businesses that collect, use or share the data of California residents. Under the CCPA, businesses must allow California consumers to opt-out of the sale of their personal information. Businesses must post “clear and conspicuous” opt-out language on their websites, allowing consumers to exercise their rights under the CCPA.

Within the United States, the CCPA is seen as the standard of privacy legislation. In large part, this is due simply to California’s size. The CCPA sets out specific requirements for how a company must honor consumers’ right to know, deletion and opt-out elections; and a number of other states are following suit. For example, in 2019, the New York Privacy Act was introduced by the State Legislature. The bill, in many respects, mirrored the GDPR’s opt-in consent requirements. However, the New York measure went further, requiring businesses to act as “data fiduciaries” for consumers. Under this proposal, businesses would have been required to place the best interests of consumers before any duties owed to its owners or shareholders. Although the bill did not gain sufficient traction during a recent legislative session and ultimately failed to become law, new data privacy compliance legislation is likely to pass in New York in the near future.

Consent and Privacy Compliance

Many of the most significant privacy laws are relatively new, and the exact requirements are still evolving. Moreover, new legislation is proposed all the time. It is impossible to predict exactly what the privacy landscape of the future will look like. However, there are steps that businesses can take today to ensure that they are flexible and able to adapt.

Only collect, use or share whatever consumer data is necessary to operate your business. Other than data obtained with the consumer’s consent, the GDPR sets forth five acceptable bases to collect, use or share consumer data. All of these bases have one thing in common: collect only what is necessary. This limits potential liability and will help streamline data management.
Use clear language. All privacy legislation seeks to increase transparency and empower consumers. Businesses should, therefore, ensure that their privacy policies are clear and unambiguous. In addition, privacy-related information should not be hidden within websites, but should be prominently featured and built into the consent portion of the online registration/purchasing process.
Create and maintain systems for consumers to revoke and limit their consent. The concept of “Privacy by Design” has spread beyond the EU, and there is every reason to expect that legislation in other jurisdictions will require businesses to afford consumers far greater data privacy rights than exist today.

Businesses’ privacy compliance obligations are always changing. To that end, it is important to work with counsel experienced in this space. If you need to review your privacy policies or need assistance understanding the changing laws affecting consumer privacy compliance, please e-mail us at info@kleinmoynihan.com, or call us at (646) 350-1736.

Attorney Advertising

CA Attorney General Releases New CCPA Law Modifications

February 12, 2020 by David Klein

Recently, the California Consumer Privacy Act (“CCPA”) regulations were modified by the California Attorney General. The latest CCPA law modifications were released on February 7, 2020, in an attempt to address issues that were raised during the public hearing and comment period that followed the release of the proposed regulations on October 11, 2019.

The California Attorney General has announced a deadline of February 24, 2020, at 5:00 p.m. (PST) to submit written comments, in yet another attempt to clarify CCPA law.

How have the proposed regulations changed?

[Read More]

California Data Broker Registration Requirements

January 16, 2020 by David Klein

January 16th, 2020

In September 2019, the California State Legislature passed Assembly Bill No. 1202 (“A.B. 1202”), amending the California Consumer Privacy Act (“CCPA”). The amendment requires qualified businesses to register as data brokers with the California Attorney General on or before January 31, 2020. A.B. 1202 defines “Data Broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” (emphasis supplied). A.B. 1202 carves out exemptions from the data broker registration requirement for most entities subject to regulation under the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Insurance Information and Privacy Protection Act, respectively.

Who is a Data Broker and what are the data broker registration requirements?

[Read More]

CCPA Law: The Private Right of Action

January 14, 2020 by David Klein

January 14th, 2020

As readers of this blog know, the California Consumer Privacy Act (“CCPA”) recently went into effect on January 1, 2020. While the California Attorney General will not bring enforcement actions prior to July 1, 2020, the CCPA’s private right of action is now in full effect. This private right of action provides California consumers with a powerful tool to seek redress if their personal information is accessed as a result of a data breach. Of course, this also means that companies that do business in California may face massive civil liability if their systems are the subject of a breach.

Who can sue under the CCPA Law, and when?

[Read More]

No Pimping: Trademark Law Protects the Goodyear Blimp

January 7, 2020 by David Klein

January 7th, 2020

On January 2, 2020, the Goodyear Tire & Rubber Company (“Goodyear”) and the Illinois-based punk rock band, The Pimps, a/k/a The Good Year Pimps (“The Pimps”), entered into a settlement agreement to resolve allegations that The Pimps: (1) had breached a previous settlement agreement entered into between the parties; (2) were infringing on Goodyear’s trademark rights; and (3) had diluted and tarnished the famous GOODYEAR name and mark, the Goodyear winged foot logo and the Goodyear Blimp logo, respectively. This is not the first time that Goodyear has had to use trademark law to prevent The Pimps from using its marks. In 2002, a cease and desist letter was sent to stop The Pimps from using “Goodyear” as part of their band name. Then, in 2007, the parties eventually entered into a settlement agreement after it was learned that The Pimps were continuing to use Goodyear’s trademarks in connection with promoting their performances and in merchandise sales. This settlement agreement was adhered to until 2018, when it was brought to Goodyear’s attention that The Pimps were again using its famous trademarks during performances and to sell merchandise.

How does trademark law prevent a band from using a similar name to that of a tire company?

[Read More]

Right of Publicity Punch: Bruce Lee Enterprises Sues Kungfu Catering

December 30, 2019 by David Klein

December 30th, 2019

Over the years, the estate of Bruce Lee, organized under the corporate name of Bruce Lee Enterprises, LLC (“BLE”), has endeavored to protect the Bruce Lee brand by filing various lawsuits throughout the world. BLE’s latest lawsuit seeks $30 million from the Chinese-based restaurant chain, Kungfu Catering Management (“KCM”), for its alleged violation of Bruce Lee’s right of publicity. KCM has questioned the timing of the lawsuit given that it has been using Bruce Lee’s image in its marketing for over 15 years. Because the right of publicity is relatively new in China and there is not a long history of case law, it will be interesting to see how this case is ultimately resolved.

What does the right of publicity protect?

[Read More]

Supreme Court Denies Cert. in TCPA Ad Case

December 2, 2019 by David Klein

On November 25, 2019, the Supreme Court of the United States denied plaintiff’s petition for certiorari, thereby upholding a decision by the Third Circuit Court of Appeals (the “Court” or “Third Circuit”) which held that an unsolicited fax sent to update a company’s database was not an advertisement within the meaning of the Telephone Consumer Protection Act (“TCPA”). The Supreme Court did not explain why it denied the petition to rule on the TCPA ad case. Therefore, the Third Circuit’s underlying opinion in Robert W. Mauthe, M.D., P.C., v. Optum Inc. continues to constitute binding precedent within the Third Circuit.

When is a fax considered an advertisement?

TCPA Ad Considerations

The defendant in the underlying case, Optum Inc. (“Optum”), maintains a national database of healthcare providers. Optum markets and sells its database to health care companies, who use it for a variety of purposes, including to validate information when processing insurance claims. As part of its effort to ensure the accuracy of its database, Optum sent an unsolicited fax to the plaintiff, a doctor, seeking to verify the plaintiff’s information. The fax message explained that it was not an advertisement. Specifically, it stated, “[t]here is no cost to you to participate in this data maintenance initiative. This is not an attempt to sell you anything.”

Although the plaintiff recognized that the fax was not intended to sell the doctor anything, he still argued that Optum’s unsolicited fax message constituted a commercial advertisement, or a TCPA ad. Accordingly, the Third Circuit analyzed the fax under a theory of “third-party liability,” in which the message could still be considered a TCPA ad because it sought commercial gain through the recipient’s interaction with a third party. To establish third-party liability, the Third Circuit held that a plaintiff must show that the subject fax: “1) sought to promote or enhance the quality or quantity of a product or services being sold commercially; (2) was reasonably calculated to increase the profits of the sender; and (3) directly or indirectly encouraged the recipient to influence the purchasing decisions of a third party.”

Plaintiff sought to assert a theory of third-party liability by arguing that, although he was not an intended purchaser of Optum’s products or services, the fax should still be considered a TCPA ad because Optum was motivated by profit in sending it. The Third Circuit rejected plaintiff’s argument. The Court recognized that Optum sent the fax to improve the information in its database and, thus, increase its profits. As the Court noted, Optum, like all businesses, takes almost all of its actions with a profit motivation. However, this did not mean that Optum’s fax constituted an advertisement requiring prior express written consent from the recipient. Indeed, the message explicitly stated that it was not an attempt to sell anything to the plaintiff. The message similarly did not encourage the plaintiff to influence the purchasing decisions of any third parties. Accordingly, the Third Circuit held that the fax sent to plaintiff did not constitute an advertisement and that Optum had, therefore, not violated the TCPA in sending it to the doctor without his requesting it.

Best Practices For Sending Commercial Faxes

By denying the petition for certiorari, the Supreme Court missed an opportunity to provide some much-needed guidance to the industry regarding fax messages and TCPA ads. While the Third Circuit’s decision was upheld, other circuits have come to different conclusions regarding what constitutes an advertisement under the TCPA. This ambiguous legal landscape means that TCPA compliance continues to be quite nuanced and technical. Please note that we have previously blogged about TCPA liability resulting from non-compliant fax ads.

Under existing TCPA rules, automated calls, texts, or faxes sent only for informational purposes require “prior express consent,” whereas advertisements contained in calls, texts, and faxes sent by automated means require “prior express written consent.” Due to the potential costs resulting from non-compliance with TCPA regulations, businesses operating in this space should work closely with knowledgeable counsel prior to engaging in any fax marketing campaign.

If you are interested in learning more about this topic or want to review your facsimile marketing practices, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising.

Similar Blog Posts:

Supreme Court Presented with TCPA Fax Issue

What is an Advertisement in a TCPA Fax Case?

Court Significantly Narrows Nationwide Fax TCPA Class Action