The CCPA’s Contractual Requirements Between Covered Businesses and Service Providers
July 23, 2019
The CCPA generally impacts three types of entities: (1) covered businesses; (2) service providers; and (3) third parties. There are certain advantages to being considered a service provider over a third party. For instance, if a business shares personal information with a third party, that can trigger certain disclosures that must be made to the consumer. See Cal. Civ. Code § 1798.110(a)(4). Likewise, third parties must provide notice to consumers before “selling” personal information they receive to others (as that word is broadly defined in the CCPA), as well as a mechanism by which consumers can exercise their newfound right to opt out. See Cal. Civ. Code §§ 1798.115(d), 1798.120(a). Any one of these obligations could prove costly for an entity to implement in practice depending on the circumstances.
Transferring personal information to a service provider, by contrast, does not necessarily trigger those additional obligations. But an entity cannot simply call itself a service provider. There are certain thresholds that must be met as set forth in the statute.
First, there must be a written contract in place between the covered business and the service provider, such as a service agreement. See Cal. Civ. Code § 1798.140(v). The absence of any agreement or written contract is a strong indication, if not concrete proof, that the entity receiving the personal information is a third party.
Second, the written contract must include certain representations. The CCPA requires the written contract to state that the service provider will not retain, use, or disclose the personal information for any purpose other than for the specific purpose of performing the services set forth in the contract. See Cal. Civ. Code § 1798.140(v). The parties must further agree to limit the collection, sale, or use of the personal information disclosed except as necessary to perform the “business purpose” for which the service provider was retained. See Cal. Civ. Code § 1798.140(w)(2). The CCPA anticipates that the “business purpose” will relate to a covered business’s “operational” needs, such as auditing, detecting security incidents, fulfilling orders and transactions, processing payments, etc. See Cal. Civ. Code § 1798.140(d). Finally, the parties must represent that they have read and understand the CCPA’s requirements. See Cal. Civ. Code § 1798.140(w)(2).
Third, those representations must be accurate. A company that receives and uses personal information for reasons beyond the operational needs of the covered business will likely be considered a third party, regardless of the representations in the written contract. Where that is unavoidable, the company must be sure to weigh the benefits of processing the personal information against the risks of being considered a third party and the costs of additional CCPA compliance.
In situations where these representations can be made and are accurate, they are simple enough to implement and could be low-hanging fruit for a business looking to demonstrate CCPA compliance by January 1, 2020. Following the passage of the European Union’s General Data Protection Regulation (GDPR), many U.S.-based businesses have been forced to enter into data processing agreements (DPAs) to supplement existing service agreements. While the CCPA does not necessarily require a DPA, more and more companies’ global privacy compliance programs are requiring one to do business. In those instances, it may make the most sense to include these representations in the DPA itself. Otherwise, a business could include them in a stand-alone addendum to its existing written service contracts.
©2024 Carlton Fields, P.A. Carlton Fields practices law in California through Carlton Fields, LLP. Carlton Fields publications should not be construed as legal advice on any specific facts or circumstances. The contents are intended for general information and educational purposes only, and should not be relied on as if it were advice about a particular fact situation. The distribution of this publication is not intended to create, and receipt of it does not constitute, an attorney-client relationship with Carlton Fields. This publication may not be quoted or referred to in any other publication or proceeding without the prior written consent of the firm, to be given or withheld at our discretion. To request reprint permission for any of our publications, please use our Contact Us form via the link below. The views set forth herein are the personal views of the author and do not necessarily reflect those of the firm. This site may contain hypertext links to information created and maintained by other entities. Carlton Fields does not control or guarantee the accuracy or completeness of this outside information, nor is the inclusion of a link to be intended as an endorsement of those outside sites.