10.11.23

A Private Equity Diligence Spotlight: Evaluating a Portfolio Company’s Compliance with the CCPA’s Latest Requirements

By Sean Hill

 

Since being enacted in June 2018 and becoming fully operative in January 2020, the California Consumer Privacy Act (the “CCPA”)[1] has been an area of focus for many investors, particularly when evaluating targets in the software or digital media spaces. This is due in large part to the fact that the CCPA was the first comprehensive state data privacy law, and it remains arguably the state privacy law with the broadest applicability. The CCPA once again became an area of renewed focus this year when the California Privacy Rights Act (the “CPRA”)[2]—which amended the CCPA—became effective on January 1st. Now that the CPRA has begun to be officially enforced, as of July 1, 2023, it is more important than ever for investors to ensure that prospective or existing portfolio companies comply with the new privacy regime.

 

Does the CCPA Apply?

Before discussing what the CCPA requires (including the new requirements imposed by the CPRA), it is helpful to understand when the CCPA does and does not apply to a business.

 

  • “Does Business” in California: To start, a company must “do[] business” in California.[3] The CCPA does not define what this means but is viewed as applying broadly to not only those entities that have a physical presence in California (e.g., an office or some employees in California) but also those entities that simply conduct sales or other transactions in California.[4] As such, entities that merely transact sales online to any state, including California, likely meet the “doing business” requirement. Moreover, if a company’s parent or other controlling entity “does business” in California, the Company is also deemed by the CCPA to be doing business in California.

 

  • Collect Personal Information of California Residents: Next, a company must collect the personal information of some California residents and have some involvement in determining the means and purposes for processing that information.[5] This technically could be information regarding as few as one California resident, although other thresholds must apply (see below). Personal information includes many different categories of data under the CCPA but must be “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.”[6] Specific categories of personal information under the CCPA include:

    • Contact information (e.g., name, mailing address, email address, IP address, social security number, driver’s license number, account name, etc.)

    • Personal information found in records protected by California statute

    • Commercial information (e.g., records of purchasing history)

    • Biometric information

    • Internet activity information (e.g., browsing history, search history, etc.)

    • Geolocation data

    • Audio, electronic, visual, thermal, olfactory, or similar information

    • Professional or employment-related information

    • Education information (as defined under the Federal Educational Rights and Privacy Act)

    • Inferences drawn from the above information to create a profile about a consumer (e.g., a consumer’s preferences or behavior)

    • Sensitive personal information

 

Note that the category of “sensitive personal information” is a new category that was added by the CPRA. It includes items such as social security number, financial information, racial or ethnic origin, genetic data, biometric data, health information, and information concerning sexual orientation.[7]

 

  • Meet at Least One of the Following Thresholds: If a company meets the above requirements, the CCPA still does not apply unless the company also meets at least one of the following three thresholds:[8]

    •  1. Had a gross annual revenue exceeding $25M USD in the prior year;

    • 2. Anually buys, sells, or shares the personal information of 100,000 or more California consumers or households; or

    • 3. Derives at least 50% of its annual revenues from the selling or sharing of personal information (of California residents).

 

In our deal experiences, the threshold that most often applies to prospective or existing portfolio companies is the first one (i.e., the $25M threshold), as it is much more difficult for a company to meet the other thresholds. The revenue threshold is measured on a company-wide basis (i.e., taking into account affiliates and subsidiaries), which makes it easier to meet.

 

What Does the CCPA (as Amended by the CRPA) Require?

 

A. Online Privacy Policy Disclosures[9] The CCPA requires that a company post an online privacy policy that contains the following disclosures:

 

  • Description of CCPA Consumer Rights: The CCPA allows consumers to exercise certain rights, which must all be listed and disclosed in the privacy policy:

    • Right to request information regarding the company’s collection and sale of personal information;

    • Right to request deletion of personal information collected about a consumer; and

    • Right to opt out of sales of personal information.

 

The right to request information includes the right for a consumer to request information regarding the categories of personal information collected about them (as well as the specific information collected), the categories of sources from which such information is collected, the categories of information that are sold (if sold at all) or disclosed to third parties, the categories of third parties to whom such information is sold or disclosed, and the business or commercial purpose for collection of the personal information from the consumer.

 

In addition, the policy will need to disclose new rights created by the CPRA and which became effective on January 1, 2023:

 

  • Right to correct inaccurate personal information;

  • Right to limit the use and disclosure of sensitive personal information; and

  • Right to opt out of automated decision-making technology.

 

Regarding the right to limit use and disclosure of sensitive information, if a company uses and discloses sensitive personal information, the CPRA requires a link on the company’s website or other online services that allows users to elect to limit the company’s use and disclosure of such information to only that which is necessary to provide the goods or services reasonably expected by an average consumer. The link should be titled “Limit the Use of My Sensitive Personal Information.”

 

Regarding automated decision-making, while not fully defined by the CPRA’s amendments, it is essentially a method of user profiling—i.e., using personal information to evaluate, analyze, or predict a personal’s economic status, health, behavior, interests, location, or movements. In our deal experience, many businesses do not engage in this practice. However, if a company does engage in this practice, an opt-out mechanism must be provided for users.

 

  • Description of Methods for Exercising CCPA Consumer Rights: The privacy policy must disclose two or more methods for a consumer to exercise the CCPA rights summarized above. Many companies use a dedicated privacy email and a dedicated privacy “hotline” toll-free number to meet this requirement.

  • Description of Categories of Personal Information Collected: The privacy policy must disclose the categories of personal information collected by a company in the preceding 12 months (i.e., before the effective date of the privacy policy), as well as the purposes for which such information is used (including, any sales or disclosures of such information, as described below). If sensitive personal information is collected, the CPRA requires that the privacy policy make a separate disclosure regarding the specific sub-categories of sensitive personal information collected, as well as the purposes for use and whether such information is sold or shared.

  • Description of Personal Information Sales or Sharing: The privacy policy must list the categories of personal information that the company has sold in the preceding 12 months. Further, the CPRA requires a general statement regarding whether or not the company sells or shares personal information. The CCPA defines “selling” as involving some exchange of monetary or other valuable consideration for the company’s provision of personal information. Further, the CPRA defines “sharing” as sharing for cross-context behavioral advertising purposes.

     

    If a company sells or shares personal information, the company must include a link on its website or other online services that allows users to opt out of such selling and sharing. The link should be titled “Do Not Sell or Share My Personal Information.” Note that this link is separate from that above regarding sensitive personal information, although some businesses have elected to combine them into a single opt-out link.

  • Description of Other Personal Information Disclosures: The privacy policy must list the categories of personal information that the company has disclosed in the preceding 12 months and the business purposes for disclosing such information. These purposes could include, for example, providing goods or services that a consumer has purchased or requested from the company.

  • Disclosure of Data Collection from Minors: The CCPA prohibits the sale of personal information of a consumer under 16 years of age without affirmative consent. As such, many companies do not collect any information from such consumers under 16 (or, often, under 18)—if this applies, a company should include a disclosure in the privacy policy that it does not collect information from consumers under 16.

  • Description of Retention: The CPRA now requires a privacy policy to disclose either the duration that personal information is retained (for each category of personal information) or, alternatively, the criteria a company uses to determine how long it will retain such information.

 

B. Methods for Exercising CCPA Rights[10] A company must implement methods internally to process CCPA data subject requests (i.e., requests of California residents to exercise the rights discussed above). This could include setting up a dedicated privacy email or hotline or an electronic request portal by which such residents can exercise their CCPA rights.

 

C. Limitations on Purpose[11] The CPRA has introduced a new requirement, which limits the purpose for which personal information can be collected and used. Namely, a company’s collection, use, retention, and sharing of personal information must be reasonably necessary and proportionate to achieve the purposes for which the information was collected and may not be processed further in a manner that is incompatible with these purposes. Legitimate “business purposes” include things such as providing services to a consumer, debugging, and ensuring security.

 

D. Reasonable Security Procedures[12] The CPRA added an additional duty on companies to implement reasonable security procedures and practices appropriate to the nature of the personal information to protect the personal Information from unauthorized or illegal access, destruction, use, modification, or disclosure.

 

E. Vendor Contractual Requirements[13] Under the new requirements of the CPRA, a company must include certain items in their contracts with vendors that act as “service providers” (i.e., entities that process personal information on behalf of a company) or “contractors” (i.e., other entities that receive personal information for a business purpose). In both cases, a company must include in their contracts provisions that prohibit the “service provider” or “contractor” from:

 

  1. selling or sharing the personal information;
  2. retaining, using, or disclosing the personal information other than for business purposes specified in the contract or as otherwise permitted by the CPRA;
  3. retaining, using, or disclosing the information outside of the direct business relationship between the parties; or
  4. combining the personal information received from or on behalf of the business with personal information received or collected in other contexts.

 

In addition, in contracts with any “contractor,” the company must also include, in addition to the items above:

 

  • (I) a certification by the contractor that they understand and will comply with the above prohibitions; and
  • (ii) a right of the company to monitor the contractor’s compliance via ongoing manual reviews, automated scans, and regular audits or testing at least once every twelve (12) months.

 

Finally, if a service provider or contractor receives personal information for any business purpose or if a company sells personal information or shares it for behavioral advertising purposes to any third party, the applicable contract must include, in addition to the items above:

 

  • (a) a statement that personal information is sold or disclosed only for limited and specified purposes;
  • (b) requirement for the third party to comply with the CPRA and provide the same privacy protection level as required by the CPRA;
  • (c) requirement for the third party to notify the company if it can no longer meet its obligations under the CPRA; and
  • (d) a provision granting the company rights to take “reasonable and appropriate steps” to help ensure the third party uses the personal information in a manner consistent with the CPRA.

 

F. Employee Privacy Notice[14] The CPRA now requires companies to provide a privacy notice, at or before the time of collection, to any employees or job applicants from whom the company collects personal data. The notice must include the categories of personal information that the company collects (including any sensitive personal information and any sub-categories therein), the purposes for which the information is used, whether the information is sold or shared, and the duration that the information is retained. The employee notice must also provide a description of the CCPA rights discussed above in Section A (Online Privacy Policy Disclosures), as employees and job applicants in California can exercise these rights as well. Finally, the notice must describe the categories of third parties to whom the company discloses or allows to collect employee personal information.

 

What Happens if a Company Doesn’t Comply?

Noncompliance with the CCPA may result in penalties, issuable by the California Privacy Protection Agency (CPPA) or the California Attorney General and private actions initiated by affected California residents. Penalties issued by the CPPA or the Attorney General can be up to $2,500 per violation or up to $7,500 per intentional violation.[15] The penalty is increased to $7,500 per violation for anything involving the personal information of consumers under 16, regardless of intentionality. In addition, if a company fails to implement and maintain reasonable security procedures and practices, as required by the new CPRA amendments, then an affected consumer can initiate a privacy action against the Company for (1) damages between $100 and $750 per consumer per incident (or, if greater, actual damages), (2) injunctive relief and (3) any other relief that a court deems proper.[16]

 

Conclusion

The CCPA presents a unique and comprehensive set of legislation affecting many technology companies, even if only operating minimally in the state of California. Given the CCPA’s complex set of requirements, both old and recent, as well as the penalties for noncompliance, it is important for investors to properly evaluate a target’s or an existing portfolio company’s level of compliance.

 

How can an investor better evaluate a target’s compliance with, or an existing portfolio company’s compliance with, the CCPA?

 

To more effectively evaluate whether a target in a private equity transaction or whether an existing portfolio company, in each case, complies with the CCPA in its most recent and amended form, we have prepared the chart below, which summarizes key questions to aid in CCPA diligence. In summary, an investor must first determine if the target or portfolio company meets the thresholds for triggering the CCPA. Next, the investor will need to determine if the privacy practices, both external (the company’s online privacy policy) and internal (the company’s internal controls, vendor controls, and employee controls), adequately meet the CCPA’s requirements. Each of these categories involves different questions to ask, each summarized below, of the target or portfolio company.

 

Notes

  1. Cal. Civ. Code §§ 1798.100 et seq.

  2. Note that the CPRA is not a separate law or act, despite its name. In this article, the CPRA is sometimes referred to separately in order to delineate between prior and new requirements under the CCPA. However, the CPRA is simply a set of amendments to the CCPA.

  3. Cal. Civ. Code § 1798.140(d).

  4. Some have sought guidance on the “doing business” term by looking to analogous terms in other California laws, such as the California Tax Code. These other laws support a broad interpretation of the term that includes merely transacting some business in California.

  5. Cal. Civ. Code § 1798.140(d).

  6. Cal. Civ. Code § 1798.140(v).

  7. Cal. Civ. Code § 1798.140(ae).

  8. Cal. Civ. Code § 1798.140(d).

  9. Cal. Civ. Code §§ 1798.100, 1798.110, 1798.115.

  10. Cal. Civ. Code § 1798.130.

  11. Cal. Civ. Code § 1798.140(e).

  12. Cal. Civ. Code § 1798.100(e).

  13. Cal. Civ. Code § 1798.140(j), 1790.140(ag).

  14. Cal. Civ. Code § 1798.100(a).

  15. Cal. Civ. Code § 1798.155(a).

  16. Cal. Civ. Code § 1798.150

Back to News

DRAG