TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

The Privacy Advisor | 'Sale' under CCPA may not be as scary as you think Related reading: IAB seeks comment on CCPA framework

rss_feed
PrivacyTraining_ad300x250.Promo1-01

This Halloween, privacy professionals are assessing whether the California Consumer Privacy Act is more "trick" or "treat." The CCPA’s confusing cross-references, sweeping definitions and private right of action are enough to keep one up at night, especially that provision on data "sale." Fortunately — just like checking under the bed for monsters — a review of the relevant legislative history and case law explains why this provision may not be as scary as some fear.  

The California legislature rejected a broad 'sale' definition.

To understand the CCPA’s "sale" definition, you need to go back to the ballot initiative that was the precursor to the CCPA statute. The original ballot initiative defined "sale" broadly to mean either:

"(A) Selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for valuable consideration; or (B) sharing orally, in writing, or by electronic or other means, a consumer's personal information with a third party, whether for valuable consideration or for no consideration, for the third party's commercial purposes."

In enacting the CCPA, the California Legislature rejected the ballot initiative’s broad definition and both struck the language in (B), which treated any sharing for commercial purposes as a sale, and clarified the meaning of "valuable consideration" in (A) by adding the more specific term "monetary" before the more generic "other valuable consideration." Specifically, the CCPA statute defines "sale" more narrowly to mean: "... selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration."

Under well-accepted theories of statutory construction, the deletion of the text in (B) must "have real and substantial effect." Specifically, the legislative revisions make clear that not all disclosures of data to a third party constitute sales of personal information (regardless of whether or not the exchange is for a commercial purpose). Rather, the plain language makes clear that there is a "sale" for CCPA purposes only where data is exchanged directly for money or similar valuable consideration. 

This interpretation is supported by the California Senate Judiciary Committee’s summary of the final CCPA bill, which stated that "'sell' as used in this bill would essentially delete this second section of the definition, importantly, the sharing of the information for no consideration to a third party for that party’s commercial use ... its effect would be that a consumer could not opt out of the sharing of their personal information with third parties, so long as there is not valuable consideration received." 

Like a zombie rising from the dead, a second privacy ballot initiative that Alastair Mactaggart recently announced attempts to return to the approach included in the original ballot imitative. The new ballot initiative appears to recognize the limits of the CCPA’s definition of "sale" by seeking the following expanded definition: "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration, or otherwise for a commercial purpose, including but not limited to cross-context behavioral advertising."

Consequently, this ballot initiative would override the intention of the California Legislature. And the characterization of cross-context behavioral advertising as a commercial purpose without valuable consideration seems to acknowledge that such advertising is not a "sale" under the current CCPA statute. 

California case law provides insight into the 'sale' definition.

Although the CCPA, which does not take effect until Jan. 1, 2020, is too new for California courts to have yet analyzed the meaning of the "sale" definition, California courts have interpreted the meaning of "valuable consideration" and "consideration" in other contexts, providing valuable insight into the limited meaning of "sale" under the CCPA.

The Supreme Court of California has "authoritatively adopted the concept of a bargained-for exchange" in the Restatement of Contracts to determine what constitutes consideration, via Jara v. Suprema Meats, Inc. The Restatement of Contracts requires a "bargained for" performance or returned promise. Under this test, the key question is whether the exchange "motivated" or "induced" the other party’s promise or performance. In the typical bargain, the consideration and the promise bear a reciprocal relation of motive or inducement: The consideration induces the making of the promise, and the promise induces the furnishing of the consideration. The analysis hinges on what both parties "so understood and intended" as the "plan and purpose for which the consideration was paid," as was held in People v. Gonzales.

Even where an exchange provides one party something of value, California courts consider it an "ancillary" or "remote" benefit rather than consideration where the record does not reflect that the parties considered the exchange material to the bargain.

For example, in People v. Cardas, a movie theater in California advertised that the theater would distribute tickets and hold a drawing to win a trip to Catalina Island. The only requirement to win was to have the winning ticket, be near the theater and claim the prize at the time it was announced. The court concluded "the holders of the prize tickets did not pay a valuable consideration for the chance of winning the prize." In doing so, the court recognized that the theater may expect to benefit given the likelihood that participants would "visit [the theater] with the expectation that they might purchase goods, and thereby increase their trade," but it found that this was "a benefit too remote to constitute a consideration for the chances."

Similarly, the fact that a third party might be able to derive some incidental benefit from the data that it receives (such as product or service development or improvement) should be immaterial to the "sale" analysis under the CCPA. For example, if two businesses negotiate a bargained-for exchange of money for the performance of services, and the money is what induces or motivates the third party to promise to perform those services, then the money is the consideration for the services (regardless of whether the third party benefits from the personal information). Consequently, to determine whether data is exchanged for monetary or similar valuable consideration, the California attorney general must consider what the parties negotiated and what motivated or induced the parties to enter into the commercial agreement. 

What businesses are doing now

Businesses are assessing whether they "sell" personal information as the effective date of the CCPA approaches. Considering the legislative history and relevant case law, the definition of "sale" seems best interpreted to require the exchange of data as part of a bargained-for exchange for money or similarly valuable consideration. In-house lawyers are reviewing their commercial agreements to assess whether data is being sold. If not, the draft regulations that the attorney general has published indicate that no sale opt-out is required. In contrast, if data is "sold" for CCPA purposes, the business should consider how to come into compliance with the CCPA’s opt-out requirements.

Photo by Justin Lim on Unsplash

2 Comments

If you want to comment on this post, you need to login.

  • comment Tanya Forsheit • Oct 29, 2019
    Thanks for publishing this Lindsey. One question and one comment: (1) how do you reconcile this interpretation with the language in the Attorney General's draft regulations in § 999.315 stating that acceptable methods for consumers to submit Do Not Sell requests include "user-enabled privacy controls, such as a browser plugin or privacy setting or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale of their personal information"? and (2) on the legislative history, I don't believe the ballot initiative itself, including the definition of sale, was ever before the legislature. The bill that was introduced on June 21, 2018 had the same definition of sale that was passed into law on June 28. The changes from the ballot initiative were negotiated between Mr. Mactaggart and the privacy advocates, on the one hand, and the industry groups, on the other hand. I don't believe the Legislature ever had a chance to reject the ballot initiative definition of sale.
  • comment Alan Friel • Nov 10, 2019
    I agree with all of Tanya's comments.  Also, the 2.0 measure proponents' position is that interest-based ad (IBA) ecosystem disclosures are already a "sale" and their 2.0 proposals are just for purposes of certainty.  Also the article's theory, when applied to a use case like IBA, relies on an application of all of the facts (just as did the cases cited) and I do not see an analysis of the exchange of benefits regarding data sharing in the IBA or any other context.  Finally, as it applies to vendors' use for themselves and their other clients, I don't see a discussion of the challenges that Reg 999.314(c) presents.
    
    This article is helpful, however, in supporting a position that, at the moment, there is not yet a consensus as to if certain uses cases are or are not a sale, especially at a time when the IAB and DAA opt-out and signal program are not yet ready to deploy.