More than a year ago, the California legislature, invoking the California constitution’s right to privacy, passed the California Consumer Protection Act (CCPA). The CCPA is a sweeping consumer privacy law that enacts some of the world’s broadest data protection regulations. After more than a year of preparation, the California Attorney General’s office released final CCPA regulations on June 1, 2020. The AG’s office finalized the regulations just in time for the law to go into effect on July 1, 2020.
What Does the CCPA Do?
Under the CCPA, California residents now have the right to…. Notably, the CCPA does not apply only to California businesses. The new law applies to any business with customers or employees in California that collects customer information and decides how it is processed. The law applies to:
- Any business collecting information from California customers, potential customers, or employees, and then directing how the use of that information, whether the business does so directly or through a third-party;
- Any business operating in California with more than $25 million in gross revenue; or
- A business that buys, shares, or sells the information of 50,000 individuals, devices, or households; or
- Any business that receives more than half its revenue from selling customer information.
Under the CCPA, California customers now have the right to:
- Know information businesses collect about them and how businesses share it;
- To delete some personal information businesses collect;
- To opt-out of the sale of personal information;
- To not be discriminated against for exercising CCPA rights.
Businesses that fail to comply with customer requests under the CCPA may face fines of $2,500 to $7,500 per incident, even if the failure was inadvertent. Those fines can accumulate fast.
The CCPA also creates a civil action for customers, with statutory damages between $100 and $750 “per consumer per incident or actual damages, whichever is greater.” Cal. Civ. Code § 1798.150(a)(1) (2018). Customers can also seek these statutory damages in addition to declaratory or injunctive relief. While large companies may be able to bear the cost of fines and civil judgments, CCPA penalties could easily bankrupt a smaller business.
CCPA Impact on Florida Businesses
In an earlier blog post, we discussed how Florida businesses will need to reassess and revamp their data collection and storage processes and develop procedures to respond to CCPA requests. But the CCPA will also affect the document retention policies of Florida businesses, pre-litigation information mining, and discovery during litigation.
- Data Retention in Preparation for Litigation
Under federal law, businesses generally are required to preserve relevant documents and other tangible evidence when they reasonably anticipate litigation. If evidence, including electronically stored data, is relevant to litigation or the business should have known that the data may be relevant to future litigation, this triggers the legal obligation to preserve evidence. See Fed. R. Civ. P. 37(e) (2015).
If a litigant fails to preserve evidence, they may be held liable for “spoliation of evidence.” The penalties for spoliation of evidence, whether unintentional or deliberate, can be severe. A court can apply an adverse inference, meaning that the court or jury will assume that the evidence would have been unfavorable to the party that destroyed the evidence. Spoliation of evidence can also result in the dismissal of a plaintiff’s case or the entry of a default judgment. As a result, businesses should take their duty to preserve evidence seriously.
Florida law is somewhat unsettled concerning when the duty to preserve evidence arises. It’s more likely that the duty to preserve evidence arises once someone files a lawsuit. But businesses tend to act conservatively and preserve evidence as soon as possible. After all, a company can’t always anticipate if the parties will litigate in state or federal court.
Unfortunately, the CCPA does not expressly address the federal rules regarding the spoliation of evidence. As a result, the statute may allow California’s Attorney General to second guess a business’s legal decision to preserve evidence for potential litigation that conflicts with a customer’s request to delete personal information under the CCPA. Moreover, companies fielding CCPA deletion requests will also have to anticipate whether that information might be subject to a litigation hold.
- Litigation Document Production
Once litigation commences, the parties have obligations to produce data and documents in response to other parties’ discovery requests. Luckily, the CCPA does permit businesses to use personal data to “[e]xercise or defend legal claims.” However, the CCPA also requires businesses to track what consumer information they share with third parties. This obligation could add yet another layer of expense and review to large document productions. For many companies, tracking this information may not even be feasible.
- Pre-litigation CCPA Requests
Attorneys could also manipulate the statute, leading to a company fielding mass pre-litigation CCPA requests from attorneys trying to mine data and information before filing a lawsuit. For class-action cases, finding out information about a class of litigants or potential individual litigants is a boon for attorneys. Under the CCPA, customers have the right to receive the information a business has about them.
Using the rights under the CCPA, attorneys could now use powers of attorney from hundreds of potential litigants to garner valuable pre-discovery information. An attorney could check on potential litigants, gain valuable insight into a business’s practices, and estimate a possible class size before filing suit. While the CCPA does permit companies to charge “a reasonable fee” for this information, that is unlikely to stop a well-financed class-action attorney.
What Happens if Florida Passes a Consumer Privacy Laws Similar to California’s CCPA?
If Florida follows California’s model in aggressively protecting consumer data, it will create an untenable situation for even more Florida businesses. Companies will be torn between their obligations to preserve and produce data for litigation and their legal duties to customers under the CCPA.
If you have questions about the CCPA and how it affects your Florida business, contact the attorneys at Boyer Law Firm, P.L., for a consultation. Our attorneys specializing in business law can help.
