The California Consumer Privacy Act (CCPA) includes an exception for publicly available information in determining the scope of personal information covered by the law.

Text of Relevant Provisions

CCPA Sec.1798.140 (v)(2):

"(2) "Personal information" does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. For purposes of this paragraph, "publicly available" means: information that is lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. "Publicly available" does not mean biometric information collected by a business about a consumer without the consumer's knowledge."

Analysis of Provisions

The CCPA explicitly excludes publicly available information from its definition of personal information. This exception serves to limit the scope of data protection requirements under the law.The provision defines "publicly available" information in three main categories:

1. Information lawfully made available from government records
2. Information reasonably believed to be lawfully made available to the general public by the consumer or from widely distributed media
3. Information made available by a person to whom the consumer disclosed it, if not restricted to a specific audience

However, the law specifically states that "

"publicly available" does not mean biometric information collected by a business about a consumer without the consumer's knowledge

". This carve-out ensures that sensitive biometric data remains protected even if it might be considered "publicly available" in some contexts.The inclusion of "

lawfully obtained, truthful information that is a matter of public concern

" in the exception further broadens the scope of information not considered personal information under the CCPA.

Implications

This exception has several important implications for businesses:

1. Data from government records: Businesses can generally use information from public government records without CCPA restrictions.
2. Consumer-published information: If a consumer makes information publicly available, businesses may have more flexibility in using that data.
3. Media-sourced information: Data obtained from widely distributed media may fall outside CCPA requirements.
4. Third-party disclosures: Information shared by consumers with third parties, if not restricted, may be exempt from CCPA protections.
5. Biometric data protection: Despite the public availability exception, businesses must still treat biometric information as personal information under the CCPA if collected without consumer knowledge.
6. Public interest information: Truthful, lawfully obtained information of public concern receives less protection, potentially allowing for broader use in journalism or other public interest contexts.

Businesses should carefully assess whether information truly qualifies as "publicly available" under the CCPA definition before excluding it from their data protection practices. The exception provides some flexibility but also requires careful consideration, especially regarding biometric data and information of public concern.