This Halloween, privacy professionals are assessing whether the California Consumer Privacy Act is more "trick" or "treat." The CCPA’s confusing cross-references, sweeping definitions and private right of action are enough to keep one up at night, especially that provision on data "sale." Fortunately — just like checking under the bed for monsters — a review of the relevant legislative history and case law explains why this provision may not be as scary as some fear.
The California legislature rejected a broad 'sale' definition.
To understand the CCPA’s "sale" definition, you need to go back to the ballot initiative that was the precursor to the CCPA statute. The original ballot initiative defined "sale" broadly to mean either:
"(A) Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration; or (B) sharing orally, in writing, or by electronic or other means, a consumer's personal information with a third party, whether for valuable consideration or for no consideration, for the third party's commercial purposes."
In enacting the CCPA, the California Legislature rejected the ballot initiative’s broad definition and both struck the language in (B), which treated any sharing for commercial purposes as a sale, and clarified the meaning of "valuable consideration" in (A) by adding the more specific term "monetary" before the more generic "other valuable consideration." Specifically, the CCPA statute defines "sale" more narrowly to mean: "... selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration."
Under well-accepted theories of statutory construction, the deletion of the text in (B) must "have real and substantial effect." Specifically, the legislative revisions make clear that not all disclosures of data to a third party constitute sales of personal information (regardless of whether or not the exchange is for a commercial purpose). Rather, the plain language makes clear that there is a "sale" for CCPA purposes only where data is exchanged directly for money or similar valuable consideration.
This interpretation is supported by the California Senate Judiciary Committee’s summary of the final CCPA bill, which stated that "'sell' as used in this bill would essentially delete this second section of the definition, importantly, the sharing of the information for no consideration to a third party for that party’s commercial use ... its effect would be that a consumer could not opt out of the sharing of their personal information with third parties, so long as there is not valuable consideration received."
Like a zombie rising from the dead, a second privacy ballot initiative that Alastair Mactaggart recently announced attempts to return to the approach included in the original ballot imitative. The new ballot initiative appears to recognize the limits of the CCPA’s definition of "sale" by seeking the following expanded definition: "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration, or otherwise for a commercial purpose, including but not limited to cross-context behavioral advertising."
Consequently, this ballot initiative would override the intention of the California Legislature. And the characterization of cross-context behavioral advertising as a commercial purpose without valuable consideration seems to acknowledge that such advertising is not a "sale" under the current CCPA statute.
California case law provides insight into the 'sale' definition.
Although the CCPA, which does not take effect until Jan. 1, 2020, is too new for California courts to have yet analyzed the meaning of the "sale" definition, California courts have interpreted the meaning of "valuable consideration" and "consideration" in other contexts, providing valuable insight into the limited meaning of "sale" under the CCPA.
The Supreme Court of California has "authoritatively adopted the concept of a bargained-for exchange" in the Restatement of Contracts to determine what constitutes consideration, via Jara v. Suprema Meats, Inc. The Restatement of Contracts requires a "bargained for" performance or returned promise. Under this test, the key question is whether the exchange "motivated" or "induced" the other party’s promise or performance. In the typical bargain, the consideration and the promise bear a reciprocal relation of motive or inducement: The consideration induces the making of the promise, and the promise induces the furnishing of the consideration. The analysis hinges on what both parties "so understood and intended" as the "plan and purpose for which the consideration was paid," as was held in People v. Gonzales.
Even where an exchange provides one party something of value, California courts consider it an "ancillary" or "remote" benefit rather than consideration where the record does not reflect that the parties considered the exchange material to the bargain.
For example, in People v. Cardas, a movie theater in California advertised that the theater would distribute tickets and hold a drawing to win a trip to Catalina Island. The only requirement to win was to have the winning ticket, be near the theater and claim the prize at the time it was announced. The court concluded "the holders of the prize tickets did not pay a valuable consideration for the chance of winning the prize." In doing so, the court recognized that the theater may expect to benefit given the likelihood that participants would "visit [the theater] with the expectation that they might purchase goods, and thereby increase their trade," but it found that this was "a benefit too remote to constitute a consideration for the chances."
Similarly, the fact that a third party might be able to derive some incidental benefit from the data that it receives (such as product or service development or improvement) should be immaterial to the "sale" analysis under the CCPA. For example, if two businesses negotiate a bargained-for exchange of money for the performance of services, and the money is what induces or motivates the third party to promise to perform those services, then the money is the consideration for the services (regardless of whether the third party benefits from the personal information). Consequently, to determine whether data is exchanged for monetary or similar valuable consideration, the California attorney general must consider what the parties negotiated and what motivated or induced the parties to enter into the commercial agreement.
What businesses are doing now
Businesses are assessing whether they "sell" personal information as the effective date of the CCPA approaches. Considering the legislative history and relevant case law, the definition of "sale" seems best interpreted to require the exchange of data as part of a bargained-for exchange for money or similarly valuable consideration. In-house lawyers are reviewing their commercial agreements to assess whether data is being sold. If not, the draft regulations that the attorney general has published indicate that no sale opt-out is required. In contrast, if data is "sold" for CCPA purposes, the business should consider how to come into compliance with the CCPA’s opt-out requirements.
Photo by Justin Lim on Unsplash
