California Consumer Privacy Enters New Era as the Supreme Court Re-Defines the Line on the Disclosure of Private Information
Owen M. Praskievicz, Esq.
Schwartz Semerdjian Cauley & Moot LLP
The times, they are a-changin’. In July 2018, the California Legislature passed a sweeping consumer privacy law dubbed the California Consumer Privacy Act of 2018. The new law, which was quickly rushed through Sacramento to avoid a ballot initiative in November, grants consumers with the right to be informed about what kinds of personal data companies have collected and why it was collected. Among other new protections when the law takes effect in 2020, consumers will have the right to request the deletion of personal information, opt out of the sale of personal information, and access the personal information in a “readily useable format” that enables its transfer to third parties without hindrance.
Most notably, the new law establishes a broad definition of “personal information,” including a consumer’s personal identifiers, geolocation, biometric data, internet browsing history, psychometric data, and inferences a company might make about the consumer. The protections over this data are enforceable by the state’s attorney general, but consumers can also enforce their rights under a private right of action if companies fail to maintain reasonable security practices, resulting in unauthorized access to the personal data.
For the attorneys reading this, that last sentence should grab your attention. The implications of a private right of action to enforce these new protections suggests there will be a wave of related new lawsuits and class actions headed to a docket near you. Yet the Act may do more than provide a welcome sword for consumer advocates to keep companies in line; it may also provide these same companies a shield in litigation where access to such information may be at issue.
By expanding the definition of “personal information,” consumer attorneys can expect companies to fight discovery requests that touch on these areas with even more intensity and new ammunition. For example, if a class action alleges unfair business practices against a company and seeks the geolocation or biodata of other potential class members, can the business point to the new law to help block disclosure? Knowing that companies now have to keep track of personal information in a “readily useable format,” might this consolidated data be useful information to obtain in discovery?
A recent case by the California Supreme Court may provide some insight into how the discovery fights for access to this private information may play out. Just one year prior to the passage of the Consumer Privacy Act, Williams v. Superior Court (2017) 3 Cal.5th 531 broadened the discovery rights of plaintiffs seeking ostensibly private information. There, the Supreme Court held that aggrieved employees suing under the Labor Code Private Attorneys General Act of 2004 (PAGA) may seek discovery of the names and contact information of other aggrieved employees without having to first show good cause. The Supreme Court reversed a decision that would have precluded PAGA plaintiffs from obtaining the contact information of other potentially aggrieved employees beyond the discrete location at which they worked without first making a threshold evidentiary showing. Rather, to justify disclosure of the contact information of all employees in California, the Supreme Court found that it is sufficient for a named plaintiff to allege that the at-issue violations occurred, that plaintiff himself or herself was aggrieved, and that the defendant employer had a systemic, statewide policy that caused injury to other employees across California.
Some viewed the Williams decision as a narrow one that only applied to employment cases. Others noted that the Court simply applied the pre-existing class action standard to PAGA cases and cautioned to not read it as an open invitation to propound unlimited statewide discovery without any preliminary showing of good cause. Indeed, the Williams court noted that its decision did not apply to other discovery devices such as requests for production, where, the Court noted, a statutory good-cause requirement exists.
However, this reading of Williams ignores a potentially broader takeaway in the Court’s restatement of the proper test to apply in cases involving discovery of potentially private information, and its disapproval of privacy cases that practitioners have relied on for years. The main issue in Williams was whether a PAGA plaintiff could get discovery without first having to show good cause, but the Court also considered whether a plaintiff should first establish whether the employees have a protectable privacy interest. If so, should the trial court balance that privacy interest against competing or countervailing interests, or assume that a protectable privacy interest already exists?
In its analysis the Court used the three-part test established in Hill v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1 to allow disclosure of the information the plaintiff sought: (1) a legally protected privacy interest; (2) a reasonable expectation of privacy in the circumstances; and (3) conduct by defendant constituting a serious invasion of privacy. Critically, the Court went on to reject a progeny of cases that required a party seeking discovery of facially private information to demonstrate a “compelling state interest” or a “compelling need,” standards which date back to White v. Davis (1975) 13 Cal.3d 757, a case that held that the state constitutional privacy right “does not purport to prohibit all incursion into individual privacy but rather [requires] that any such intervention must be justified by a compelling interest.” Id. at p. 775.
Nearly two decades later in Hill, the Supreme Court clarified White by noting that not “every assertion of a privacy interest … must be overcome by a ‘compelling interest,’” (Hill, 7 Cal.4th at 34-35). In the intervening 20 years, however, a laundry list of cases applied the “compelling interest” standard to nearly every privacy case. Instead, Hill stated, the requirement to show a “compelling interest” only applies when the information being sought would involve an invasion of “autonomy privacy,” which is a privacy interest “in making intimate personal decisions or conducting personal activities without observation, intrusion, or interference.” Id. at 35.
In other words, as the new era of privacy standards take hold in California, it is important for attorneys to recognize what private information they can obtain in discovery and to stay abreast of new cases interpreting the line. One can expect a host of new cases to filter through the appellate courts as litigants test the line in trial court. Readers of this column should be at the forefront of those battles.