File folders with a small lock in the corner

Will the CCPA and Other State Privacy Laws Face Constitutional Attack?

Image Credit: Pettycon from Pixabay

This article is Part 2 of 3 in a series exploring proposed federal privacy laws and constitutional concerns of privacy laws in the United States. Part 3 will discuss the constitutional challenges facing a proposed federal privacy law. 

In the first part of this series, we examined several federal privacy bills proposed this year, as Congress eagerly tries to pass a single harmonizing federal law. The issue of preemption continues to divide Republican and Democrat lawmakers, however, with the former in favor of an express provision allowing preemption stricter state privacy laws such as the CCPA and the latter largely against such a provision. 

Regardless of whether a federal law passes, with an express preemption provision, state privacy laws are still at risk of constitutional attacks. There are two primary ways that a state privacy law may be challenged: (1) invalidation under the Dormant Commerce Clause, and (2) invalidation under First Amendment grounds. State legislators contemplating the passage of their own privacy laws will need to consider these constitutional issues in the drafting phase, or risk facing opposition on constitutional grounds.

Dormant Commerce Clause

Extraterritoriality

Under the Dormant Commerce Clause, the doctrine of extraterritoriality invalidates state laws attempting to regulate commerce that occurs outside state borders. See Edgar v. MITE Corp., 457 U.S. 624, 642–643. Even if legislators did not intend a law to reach extraterritorially, that intention is not definitive of whether the law regulates commerce outside state borders. “The critical inquiry is whether the practical effect of the regulation is to control conduct beyond the boundaries of the State.” Healy v. Beer Inst., Inc., 491 U.S. 324, 336 (1989) (citing Brown-Forman Distillers Corp. v. N. Y. State Liquor Auth., 476 U.S. 573, 579 (1986)).

In evaluating a law’s extraterritorial reach, judges must also “[consider] how the challenged statute may interact with the legitimate regulatory regimes of other States and what effect would arise if not one, but many or every, State adopted similar legislation.” Healy, 491 U.S. at 336. The broad purpose of the Commerce Clause is to prevent one state from encroaching jurisdiction lines and imposing its own regulatory schema onto another state, and reducing onerous inconsistencies in legislation.

Therefore, the critical question becomes: does a state’s privacy law attempt to regulate commerce outside of state borders? 

Considering the nature of the internet—most likely yes. “The Internet is a decentralized, global communications medium linking people, institutions, corporations, and governments all across the world.” Am. Libraries Ass’n v. Pataki, 969 F. Supp. 160, 164 (S.D.N.Y. 1997). Given that the purpose of the Internet is to facilitate far-reaching communications between people and organizations across both state and country lines, a state’s privacy law will almost certainly regulate commerce outside state borders in practice, if not intentionally so. Many companies process data of internet visitors without gathering geolocation data. In such cases, rather than risk noncompliance, some businesses will ostensibly choose to comply with all state privacy laws regardless of the location of its customers. For instance, a small business located outside of California with minimal contacts with California consumers may have little choice but to comply with the CCPA if it has no idea where its users are located. Practically speaking, a state privacy law will invariably affect commerce outside state borders. 

Furthermore, the effects of privacy enforcement will be more apparent once more state and local governments pass their own privacy laws. The term “patchwork” is often used to describe state and local privacy laws today—but it could look even more disjointed. Theoretically, if every state passed its own version of California’s CCPA, then compliance with all 50 state privacy laws may not be feasible, if there are inconsistent instructions. Businesses already see this happening with state breach notification laws. Each law dictates its own special rules and thresholds for notifying the state Attorney General, state Department of Health Services, or other authority, as well as time to notification and contents of notification. 

Pike v. Bruce Church, Inc.

Even if a law may incidentally regulate extraterritorial commerce, that law may be justified when subjected to a balancing test weighing the burden of the law against a legitimate state interest. See Pike v. Bruce Church, Inc., 397 U.S. 137 (1970). In Pike, the Supreme Court held that a state law serving a legitimate interest is only invalid when “the burden imposed on [interstate] commerce is clearly excessive in relation to the putative local benefits.” Pike, 397 U.S. at 142.

The question then becomes: do the benefits to consumer privacy protection resulting from a state’s privacy law outweigh any burden on interstate commerce?

This is likely where the true battle will be fought. In 2017, the cost of privacy compliance for multinational companies ranged from $1.4 million to $21.6 million, with a median cost of $4 million per company. Predictably, a fair portion of these total costs include the price of compliance with a multitude of state and local privacy laws. Privacy compliance is a costly endeavor widely impacting organizational, operational, and technical business processes and will likely continue to grow in the next ten years. Despite these sky-rocketing costs, many opine that state privacy laws, even the most stringent laws like the CCPA, do not actually provide consumers with significant protection. There is much room for argument in this area and the balancing of interests will continue to shift as costs change and the benefits to consumers become more concrete.

American Libraries Association v. Pataki

The Dormant Commerce Clause has already been invoked to analyze the constitutionality of a state law regulating internet activity. In 1997, the U.S. District Court for the Southern District of New York overturned a state law prohibiting the online dissemination of content depicting “nudity, sexual conduct or sado-masochistic abuse” to minors. Pataki, 969 F. Supp. at 163. The plaintiffs to the action included content-providing library organizations and the ACLU, among others, who sought to enjoin enforcement of the law for fear of prosecution.

The limitation of this case is obvious—being only a federal trial court opinion, it cannot command precedent as mandatory authority. However, Pataki provides persuasive authority and a line of reasoning that other courts may adopt in the context of Internet regulation.

First Amendment

A court may also invalidate a state’s privacy law if it finds a violation of a speaker’s First Amendment right to free speech.

Judges examine the constitutionality of laws through several levels of scrutiny depending on the interests involved. For example, in the context of First Amendment rights, political and ideological speech is generally protected under the strict scrutiny standard. If the government regulates political or ideological speech, the government must show that the law is narrowly tailored to achieve a compelling government interest. However, judges examine laws regulating commercial speech—regarded as less important to protect—with intermediate scrutiny. Restrictions that are based on the content of speech or the identity of the speaker receive a “heightened” scrutiny—somewhere in between intermediate and strict scrutiny. Therefore, the type of speech that a privacy law purports to regulate will be very significant to the determination of which standard to apply, and by proxy, whether it is likely to be found constitutional or unconstitutional.

Finally, First Amendment jurisprudence not only protects the rights of speakers, but also the rights of listeners to access papers, information, and ideas. While individuals more frequently wield First Amendment law as a shield rather than a sword, some have argued for access to public court records using First Amendment law as a sword when those records are in danger of deletion due to privacy concerns. (For more in-depth discussion on the right to access public court records subject to a “right to deletion” or “right to be forgotten” request, please see Personal Privacy Should Not Outweigh Access to Public Court Records.)

Sorrell v. IMS Health Inc.

In Sorrell, a Vermont law prohibited the sale of pharmacy records (“prescriber-identifying information”) that tracked doctors’ prescribing practices to marketers of pharmaceutical and drug companies. The intended purpose of the law was to protect medical privacy. The Supreme Court struck down the law, finding it to be a content-based restriction of commercial speech because the law prohibited the disclosure of records for marketing purposes, but not for others, such as for research or educational purposes. Therefore, the Vermont law was subject to a heightened scrutiny standard. Under the heightened standard, the Court did not find the law necessary to protect medical privacy.

Sorrell is instrumental for the proposition that a state law’s limitations on who may receive data may lead the court to a finding that the law restricts speech based on content or speaker, leading to application of a heightened scrutiny standard. Notably, the dicta in the opinion also points to possible treatment of the processing and sale of data as speech worthy of First Amendment protections—not as conduct nor a commodity.

While federal lawmakers continue to debate over the provisions to be included in a federal privacy law, state legislators may themselves be deliberating over whether to pass a state privacy law as a gap filler. However, any state legislator should consider the above issues and work proactively to eliminate constitutional concerns through careful drafting.

Should putative class members have privacy rights in class action claims under the CCPA?

Privacy Rights in Class Action Lawsuits – Should Putative Class Members Opt-In Before Their Personal Information Is Disclosed in California Consumer Privacy Act Litigation?

[Originally published in Orange County Lawyer Magazine, May 2019, Vol. 61 No.5.,by Lily Li and Matthew Wegner; Image Credit: kmicican from pixabay.com]

In 2020, the nation’s toughest data privacy law will take effect in California. The California Consumer Privacy Act of 2018 (CCPA) imposes harsh restrictions on companies seeking to sell consumers’ data, including statutory penalties for any breaches of data. This legislation was spurred by public outrage against the Facebook-Cambridge Analytica scandal and Equifax, Target, and Yahoo data hacks, and reflects a growing trend to protect consumer data privacy.

As with so many legislative and judicial movements in California—for example, the Save-On decision, which ushered in a wave of wage-and-hour class actions in the early 2000s, or Business & Professions Code section 17200, which before Proposition 64 was tacked-on to countless consumer class actions—the CCPA is likely to usher in a host of new class action litigation as plaintiffs (and their attorneys) seek to recover statutory damages for data privacy violations.

Read More
Lily Li - Metaverse Law - Data Privacy - Critical Mass

Metaverse Law on Critical Mass Radio Show

On February 13, 2019, Lily Li of Metaverse Law appeared on Critical Mass Radio Show to discuss trends in privacy law and general pointers for businesses. Three takeaways from the show include:

  1. Regardless of the size of your company, consider data privacy. The size of your company itself is not as relevant as is the customer data you process. Even if you are a small company, but have a large customer base, chances are you should be looking at the data privacy regulation in your state. If you have customers overseas, such as in Europe, it is important to realize that you will then fall under European privacy laws. Privacy laws have to do with where your customers are, rather than simply where your company is based. Be aware and do your research to ensure that you are complying to the regulation that impacts your firm.
  2. Data belongs to the individual. While in the past, customer data was thought of as the company’s intellectual property, this is no longer the case. Customer data belongs to the individual, so treat it like it is their property ­ not just yours. Your clients have the right to tell your company what they want (and don’t want) done with their data, so it is crucial to ensure that you have a process in place to comply and verify with your customer.
  3. Put your data house in order. Data security affects many departments in your company, from the front end to the back end. As such, it is important to find a workflow so customer data is protected throughout its entire life cycle. Start by gathering all of your company’s department heads together in a room and ask them this key question: “Where do you store data?” From there, it will be clear what needs to be addressed when it comes to your data.

Listen to the full interview here:

Privacy Law Forecast for 2019

Image Credit: ID 23689850 © Steve Ball | Dreamstime.com

This past year was quite a whirlwind for privacy and cybersecurity watchers. Just to sum up a few of the top events of last year:

  • Facebook’s Cambridge Analytica scandal rocked political headlines
  • Europe introduced the GDPR, the most comprehensive data protection legislation to date in the world
  • California enacted the California Consumer Privacy Act, becoming the first US state to create GDPR-style rules
  • Google came under fire for allowing app developers to read your email, and track your location (even with location tracking off!)
  • Marriott’s guest reservation system was hacked, exposing the personal information of up to 500 million guests, including passport numbers and payment numbers for some of those hacked

What will happen in 2019? Here are our top 5 predictions:

Read More
California Consumer Privacy Act vs GDPR

California Consumer Privacy Act vs GDPR – How to Maximize Your Privacy Compliance Program

California’s recent passage of the Consumer Privacy Act of 2018 now places the world’s fifth-largest economy under European style data protection rules. Given the new law, US businesses that were previously hesitant to implement GDPR are now reconsidering their position.

Luckily, the GDPR and the California Consumer Privacy Act (CCPA or CaCPA) share some similarities. Both provide for consumer-facing privacy notices, data access rights, and data portability. As businesses automate their GDPR compliance processes, they should also leverage those same processes under the CaCPA to save significant time and expense.

Below, we have listed five common operational steps that all businesses should take in their GDPR and CaCPA privacy compliance programs:

Read More
1 2