Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

On April 2, the California Privacy Protection Agency (CPPA) Enforcement Division issued <a href="https://cppa.ca.gov/pdf/enfadvisory202401.pdf" target="_blank" rel="noreferrer noopener">Enforcement Advisory No. 2024-01</a>, the first among several the agency expects to release this year. <a>Enforcement Advisories seek to promote voluntary compliance with the California Consumer Privacy Act, as amended, and its implementing regulations (collectively, CCPA). </a>This first Enforcement Advisory focuses on the CCPA’s data minimization requirements in the context of consumer data privacy requests.

contentpilot/introduction

core/heading

According to the CPPA, <a>Enforcement </a>Advisories are intended to “educate the public and encourage businesses to comply with the law to the benefit of all Californians, and address selectprovisions of the <a>CCPA.</a>” The CPPA cautions that its Enforcement Advisories do not implement, interpret, or make specific the law it enforces or administers, nor do they establish substantive policy or rights, constitute legal advice, or reflect the views of its board. It further emphasizes that Enforcement Advisories do not provide options for alternative relief or safe harbor from potential violations. Instead, they call attention to selected areas of the law and provide examples of how businesses may review their practices to ensure compliance.

core/paragraph

Scope of Enforcement Advisory No. 2024-01

Enforcement Advisory No. 2024-01 is titled “Applying Data Minimization To Consumer Requests.” Data minimization is the principle that businesses should not collect, use, retain, or share more personal information than they need when processing consumers’ personal data to reduce the risk that unintended persons or entities will access personal information (e.g., through data breaches) and to support good data governance.

The Enforcement Advisory states that “certain businesses are asking consumers to provide excessive and unnecessary personal information” in response to CCPA consumer privacy requests. It highlights areas where data minimization applies in the CCPA regulations and signals these four instances:

core/list

The CPPA limits a business’ collection, use, retention, and sharing of a consumer’s personal information to that which is reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed or for another disclosed purpose. The CCPA regulations clarify that this determination is based on the minimum personal information that is necessary to achieve the purpose identified, the possible negative impacts on consumers, and the existence of additional safeguards (e.g., encryption, automatic deletion of the personal information) to specifically address the possible negative impacts on consumers.

In discussing the concept of data minimization, the Enforcement Advisory underscores the term “beyond what is necessary” as it relates to the four instances noted above and outlines general rules to apply data minimization to identity verification that include:

The Enforcement Advisory provides two examples to illustrate data minimization in the context of consumer requests. The first focuses on responding to requests to opt out of selling/sharing personal information. Notably, the Enforcement Advisory reminds businesses that the CCPA prohibits them from requiring consumers to verify their identity to opt out of sale/sharing or to make a request to limit. The second example applies data minimization to procedures for verifying a consumer’s identity (to exercise deletion rights).

The examples present a series of self-assessment questions that businesses should consider when responding to consumer data privacy requests, summarized as follows:

The Enforcement Advisory also provides questions businesses should consider when conducting identity verification in relation to consumer requests:

Compliance with the data minimization principle is squarely within the CPPA’s enforcement agenda and businesses should incorporate the recommendations presented in Enforcement Advisory No. 2024-01 to ensure that their business practices do not exceed collecting and processing consumers’ personal data beyond what is necessary and proportionate under the CCPA.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.

This document may be considered attorney advertising in some jurisdictions.

https://admin.thompsonhine.com/wp-content/uploads/2024/04/Privacy-Cybersecurity-Update-CPPA-Releases-First-Enforcement-Advisory.pdf

CPPA Releases First Enforcement Advisory

Services