The Research Exception to the CCPA’s Right to Deletion — Will It Ever Apply?
This right to deletion, however, is not without its limitations. See § 1798.105(d)(1)–(9). One such limitation is the exception for “scientific, historical, or statistical research,” which provides:
(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:
* * *
(6) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.
§ 1798.105(d)(6).
While seemingly useful at first glance, this exception will likely prove difficult for most businesses to use in practice. First, the research to which the exception applies must be “public,” “peer-reviewed,” and in the “public interest.” In addition, the definition of “research” in section 1798.140(s)(8) provides that the “research” shall “[n]ot be used for any commercial purpose.” It is hard to imagine what type of “public interest” research would be conducted by a business that does not advance the business’s commercial or economic interests. See § 1798.140(f).
Adding to the puzzle is the research exception’s requirement that it applies only when “the businesses’ deletion of the information is likely to render impossible or seriously impair the achievement of such research.” The section 1798.140(s) definition of “research” already requires all personal information used in “research” to be “pseudonymized and deidentified, or deidentified and in the aggregate.” § 1798.140(s)(2). Given this requirement, it appears that it will be quite difficult for any business to show that the deletion of a particular consumer’s personal information will “seriously impair” the research.
The research exception also applies only “if the consumer has provided informed consent.” As drafted, it is not clear whether this means that the consumer must have given initial informed consent for the business to use his or her personal information in the study or whether the consumer must consent to the business or service provider continuing to use his or her personal information after the business determines that the data is necessary to continue its research. In practice, either interpretation is likely to substantially limit the operation of the research exception.
In the end, the research exception is seemingly too narrow to actually apply in the real world. But not all is lost for businesses that use personal information in their research. Section 1798.105(d) contains other, broader exceptions to the right to deletion, including exceptions for information necessary to provide a good or service reasonably anticipated by the consumer, for information used internally that aligns with the expectations of the consumer based on the consumer’s relationship with the business, and for information used internally that is compatible with the context of the consumer’s relationship with the business. §§ 1798.105(d)(1), (7), (9). A savvy business or service provider could attempt to use these broader exceptions to retain personal information used for commercial research when faced with a deletion request, even if the research exception does not apply.
The information on this website is presented as a service for our clients and Internet users and is not intended to be legal advice, nor should you consider it as such. Although we welcome your inquiries, please keep in mind that merely contacting us will not establish an attorney-client relationship between us. Consequently, you should not convey any confidential information to us until a formal attorney-client relationship has been established. Please remember that electronic correspondence on the internet is not secure and that you should not include sensitive or confidential information in messages. With that in mind, we look forward to hearing from you.