Disclaimer

The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.

 Skip to Content

The Research Exception to the CCPA’s Right to Deletion — Will It Ever Apply?
July 17, 2019
Following in the footsteps of the GDPR, the California Consumer Privacy Act of 2018 (CCPA) grants California consumers the so-called right to deletion when it goes into effect January 1, 2020. Section 1798.105(a) provides that “[a] consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer.”

This right to deletion, however, is not without its limitations. See § 1798.105(d)(1)–(9). One such limitation is the exception for “scientific, historical, or statistical research,” which provides:

(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:
 

 * * *

 (6) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.

§ 1798.105(d)(6).

While seemingly useful at first glance, this exception will likely prove difficult for most businesses to use in practice. First, the research to which the exception applies must be “public,” “peer-reviewed,” and in the “public interest.” In addition, the definition of “research” in section 1798.140(s)(8) provides that the “research” shall “[n]ot be used for any commercial purpose.” It is hard to imagine what type of “public interest” research would be conducted by a business that does not advance the business’s commercial or economic interests. See § 1798.140(f).

Adding to the puzzle is the research exception’s requirement that it applies only when “the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research.” The section 1798.140(s) definition of “research” already requires all personal information used in “research” to be “pseudonymized and deidentified, or deidentified and in the aggregate.” § 1798.140(s)(2). Given this requirement, it appears that it will be quite difficult for any business to show that the deletion of a particular consumer’s personal information will “seriously impair” the research.

The research exception also applies only “if the consumer has provided informed consent.” As drafted, it is not clear whether this means that the consumer must have given initial informed consent for the business to use his or her personal information in the study or whether the consumer must consent to the business or service provider continuing to use his or her personal information after the business determines that the data is necessary to continue its research. In practice, either interpretation is likely to substantially limit the operation of the research exception.

In the end, the research exception is seemingly too narrow to actually apply in the real world. But not all is lost for businesses that use personal information in their research. Section 1798.105(d) contains other, broader exceptions to the right to deletion, including exceptions for information necessary to provide a good or service reasonably anticipated by the consumer, for information used internally that aligns with the expectations of the consumer based on the consumer’s relationship with the business, and for information used internally that is compatible with the context of the consumer’s relationship with the business. §§ 1798.105(d)(1), (7), (9). A savvy business or service provider could attempt to use these broader exceptions to retain personal information used for commercial research when faced with a deletion request, even if the research exception does not apply.
Authored By
Image: Gregory A. Gidus
Gregory A. Gidus
Related Practices
Cybersecurity and Privacy
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.