California: Statutory Requirement Processing Exception under the CCPA

The Statutory Requirement Processing Exception in California’s Consumer Privacy Act (CCPA) provides that certain obligations imposed on businesses do not apply when compliance would violate an evidentiary privilege under California law. This exception allows businesses to process and share personal information as part of privileged communications without contravening the CCPA, ensuring that legal obligations are fulfilled while maintaining confidentiality.

Text of Relevant Provisions

CCPA 1798.145(b):

"(b) The obligations imposed on businesses by Sections 1798.110, 1798.115, 1798.120, 1798.121, 1798.130, and 1798.135 shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law and shall not prevent a business from providing the personal information of a consumer to a person covered by an evidentiary privilege under California law as part of a privileged communication."

Analysis of Provisions

• Statutory Requirement Processing Exception: The provision under Section 1798.145(b) of the CCPA outlines an exception to the obligations imposed on businesses, specifically in situations where complying with the CCPA would conflict with an evidentiary privilege recognized under California law. Evidentiary privileges typically protect certain communications, such as those between a lawyer and their client, from being disclosed.
• Scope and Applicability: This exception is narrowly tailored to situations where the business is required to maintain confidentiality under legal privilege. The obligations under Sections 1798.110, 1798.115, 1798.120, 1798.121, 1798.130, and 1798.135, which include consumer rights to access, deletion, and opting out of the sale of personal information, do not apply in these cases.
• Legal Framework and Rationale: The rationale behind this exemption is to avoid a conflict between the CCPA and established legal principles protecting privileged communications. This ensures that businesses can comply with statutory obligations related to privileged information without breaching the CCPA. The law recognizes that in some instances, the need to protect confidential communications under legal privilege outweighs the consumer's data protection rights.

Implications

• For Businesses: Businesses in California that handle personal data as part of privileged communications, such as legal firms or medical institutions, should be aware of this exception. It allows them to process and share personal information without complying with certain CCPA requirements, provided they do so under the scope of an evidentiary privilege.
• Compliance Considerations: Companies must carefully assess whether their processing activities fall under this exemption to avoid unnecessary compliance efforts. However, they must also ensure that this exemption is not misused to bypass legitimate CCPA obligations in situations where the evidentiary privilege does not apply.