ChatGPT got the early press, and every day we learn of new generative artificial intelligence products that can create new and creative visual and text responses to human input. Following on ChatGPT’s fame, Google’s Bard and Microsoft’s Bing are now grabbing some of the spotlight, but these are merely a few of the hundreds if not thousands of generative artificial intelligence products currently available or in development—there is no question that generative AI is here to stay. Indeed, social media and other platform companies—TikTok (using AI to create or add effects to images), Instacart (to create shopping lists and answer food questions), and Shopify (to generate product descriptions), to name a few—are already integrating AI into their services.

Among all the questions begged by this innovative technology are some critical issues concerning privacy. While only time will tell the extent of the privacy issues, some of the concerns are already clear.
Continue Reading I Always Feel Like AI Is Watching Me: Artificial Intelligence and Privacy

It was my pleasure to join Farella exempt organizations partner and host of the EO Radio Show podcast, Cynthia Rowland, for a discussion on privacy laws and how they affect information collection and online activities by nonprofits.

We begin our conversation with some basic background on when a nonprofit needs a privacy policy on its website and how to think about what should be posted on the website, and where.

The current privacy requirements in California do not currently apply to most nonprofit organizations. But there are a number of reasons a nonprofit might want to think about collecting and protecting the data as if it were subject to such privacy requirements.
Continue Reading Privacy Policy Best Practices for Nonprofits

Shortly before Privacy Day, California Attorney General (Cal AG) Rob Bonta announced a California Consumer Privacy Act (CCPA) enforcement sweep that targeted mobile applications.

The sweep focused on popular apps in the retail, travel, and food service industries, which allegedly failed to comply with consumer opt-out requests. The sweep also included businesses that failed to comply with requests submitted by consumers’ authorized agents, including those sent by Permission Slip, a mobile app that allows consumers to send opt-out and deletion requests on the consumer’s behalf.
Continue Reading California Attorney General Announces Enforcement Sweep of Mobile Applications

Since the California Consumer Privacy Act (“CCPA”) was passed in 2018, employers have been watching carefully to see how the law will apply to data collected and maintained about their employees. Up until now, employment data had been exempted from most of the CCPA’s requirements. But the new amendments to the CCPA embodied in the California Privacy Rights Act (“CPRA”) come into effect on January 1, 2023, and that, coupled with the fact that the legislature failed to extend the employer exemptions, means that many categories of human resources data will be subject to the requirements of the law.[1]

The Current CCPA Employer Exemptions Are Expiring

As it stands (and through the end of 2022), covered employers are only obligated to notify employees of the categories of data being collected and the purposes for which the data will be used. In the event of a security breach involving employee data, employers are required to notify affected individuals and could be liable for statutory damages. In response to these requirements, most covered employers developed privacy notices with the required disclosures and reviewed their data security policies and protocols to ensure consistency with best practices.

But starting in 2023, employee data will be treated as any other commercial information, and covered employers will need to add employee and human resources data to their ongoing compliance efforts. Indeed, under the CCPA, “personal information” is defined broadly to include information that “identifies, relates to, describes, is reasonably associated with, or could reasonably be linked, directly or indirectly, with a particular consumer household.” Cal. Civ. Code § 1798.140(o)(1). In the employee or human resources context, personal information could include an employee’s contact information, insurance and benefits elections, bank and direct deposit information, emergency contacts, dependents, resume and employment history, performance evaluations, wage statements, time punch records, stock and equity grants, compensation history, and many other forms of data routinely collected in the context of the employment relationship. Moreover, the CPRA introduces a new concept of “sensitive personal information” (such as financial information, social security numbers, communications content, health information, and biometrics) that must be considered and addressed by the employer.

New Requirements Take Effect in 2023

So what does this mean for employers? First, employers must prepare and provide a privacy notice to an employee (or a job applicant since such applicant is likely providing personal information) at or before the time personal information is collected. This could mean including a privacy policy (and a click-through mechanism) on any online application site, in the employee handbook, and/or on internal websites. The privacy policy is likely to be similar to the online privacy policy the employer includes for consumers, though it will need to be revised to accurately reflect the categories of personal information collected (along with the length of time the employer intends to retain data in each category), as well as the categories of third parties with whom such information will be shared (e.g., payroll service providers, etc.).
Continue Reading Employee Data Under the CCPA: Expiration of Employer Exemptions Requires Compliance as of January 1, 2023

As companies prepare for the provisions of the California Privacy Rights Act (“CPRA”) to come into effect in January 2023, California Office of Attorney General (“OAG”) has signaled that companies should not wait to start complying with the Global Privacy Control (“GPC”). A recent lawsuit and subsequent $1.2 million settlement by the OAG against French e-commerce company Sephora, Inc. that targeted compliance with the GPC. In announcing the settlement, the OAG also made it known that it had “also sent notices today to a number of businesses alleging non-compliance relating to their failure to process consumer opt-out requests made via user-enabled global privacy controls, like the GPC” because, “[u]nder the CCPA, businesses must treat opt-out requests made by user-enabled global privacy controls the same as requests made by users who have clicked the ‘Do Not Sell My Personal Information’ link.” In other words, the OAG is taking the position that the California Consumer Privacy Act (“CCPA”) already requires implementation of the GPC.
Continue Reading California AG Signals Enforcement of the Global Privacy Control Under the CCPA

Earlier this year, a number of individuals brought a lawsuit in the United States District Court for the Western District of Washington against Washington-based company Wyze Labs, Inc (Wyze), which manufactures “smart” home cameras and security equipment. See In re: Wyze Data Incident Litigation, Case No. C20-0282-JCC (W.D. Wa. 2020). The lawsuit – which centered around a 2019 data breach incident – alleged that Wyze failed to comply with Federal Trade Commission requirements for safeguarding users’ personal information.
Continue Reading Arbitration Agreements in Privacy Disputes: The Wyze Decision and the CCPA

During these particularly trying times resulting from the COVID-19 pandemic, businesses of all sizes have been concerned about the future. As a result, considering potential liquidation or restructuring through bankruptcy is inevitably starting to become a reality for some. Companies in this situation should keep privacy concerns in mind, because the handling of personal data in bankruptcy proceedings poses some unique challenges.

By taking proactive measures, a business can transform the personal data it holds from a reorganization liability into an asset. However, the issue of whether or not personally identifiable information (PII) can be sold (and under what terms) is a common way privacy issues come into play during liquidation and reorganization proceedings. As further discussed below, the GDPR and the CCPA, along with the prior positions taken by the FTC and various State Attorneys General, are all factors for companies to consider to ensure that data does not lose its value as part of the bankruptcy process.
Continue Reading Privacy During Bankruptcy Proceedings: Why It Matters

With a little time to consider the finalized California Consumer Privacy Act regulations released by the California Attorney General on August 14, 2020, it is clear that some last-minute negotiations (or perhaps just some thoughtful additional analysis) took place that led to some unexpected changes. The lion’s share of the regulation requirements have been discussed in depth, so let’s just focus on the following noteworthy changes:
Continue Reading Twists in the Plot: California AG Releases Final CCPA Regulations

Californians for Consumer Privacy has announced that it has secured and submitted enough signatures to qualify its California Privacy Rights Act (“CPRA”) for inclusion on California’s November 2020 ballot.

Alistair Mactaggart, the architect behind the ballot initiative that led to the California legislature’s adoption of the CCPA, pushed forward with the CPRA to amend perceived issues and shortcomings in the CCPA.
Continue Reading Signatures Submitted for Inclusion of New California Privacy Law on November Ballot

As we are all well aware by now, the California Consumer Privacy Act (CCPA) (Cal. Civ. Code Sections 1798.100 et seq.) went into effect on Jan. 1. Through its amendments and regulations (the latter of which have yet to be finalized as of this article’s publication), one aspect of the act has stayed largely consistent: the CCPA grants a private right of action only in limited situations. While the California Attorney General has the ability to impose fines for any CCPA violation, the private right of action is specifically limited (over significant debate and a proposed amendment that failed to pass) to data breach. Moreover, in creating that private right of action, the act specifically notes that violations “shall not be interpreted to serve as the basis for a private right of action under any other law.”

Does that mean there will not be significant litigation concerning the CCPA outside of the data breach realm? The answer is clearly a resounding “no.” Indeed, we have already seen multiple lawsuits filed taking direct aim at the CCPA’s claimed limitations on private enforcement. In those cases, in direct contravention of the stated limitation on private rights of action, plaintiffs have claimed (among other things) that the failure to provide proper notice required by the CCPA predicates a violation of California’s Unfair Competition Law (Cal Civ. Code. Section 17200) (the UCL). See, e.g., Burke v. Clearview AI, Case No. 3:20-cv-00370 (S.D. Cal., filed Feb. 27, 2020); Sheth v. Ring, Case No. 2:20-cv-01538 (C.D. Cal., filed Feb. 18, 2020). Whether such claims will fail as expressly barred by the act remains to be seen.
Continue Reading Private Rights of Action and the CCPA—Unlimited Limitation?