/>iThe California Consumer Privacy Act (the “CCPA”) went into effect on January 1, 2020. CPW has covered some of the privacy litigations involving the CCPA (and the first CCPA class action settlement). For those of you wondering whether the CCPA limited the scope of discovery in litigation, at least one federal court last year held it does not. Will Kaupelis v. Harbor Freight Tools USA, Inc., Case No. 19-01203 (C.D. Cal.)
As a reminder, the CCPA regulates any “business” that “does business in California,” even those without a physical presence in the state, and determines the means and purposes of the processing of “personal information” (“PI”). Aligning with the European Union’s General Data Privacy Regulation (“GDPR”), the CCPA defines “personal information” to include “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Cal. Civ. Code § 1798.140(o).
The CCPA requires compliance with its notification and transparency notices. First, the CCPA expects businesses present up to four notices, to be determined by that business’s practices. Second, businesses must also inform consumers of their rights under the CCPA including their: (1) right to know, (2) right to delete, (3) right to opt out, (4) right to not be discriminated against for exercising their CCPA rights.
However, nothing in the CCPA limits civil discovery. Instead, the statute simply states that it is not a restriction on a business’s ability to comply with federal law (which would seemingly include the Federal Rules of Civil Procedure). Cal. Civ. Code § 1798.145(a)(1); see also id. at § 1798.196 (“This title is intended to supplement federal and state law, if permissible, but shall not apply if such application is preempted by, or in conflict with, federal law or the United States or California Constitution.”). The CCPA also provides that it “shall not restrict a business’ ability to . . . comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.” Id. at § 1798.145(a)(2).
Which brings us to Will Kaupelis. The case was brought as a putative class action. It concerned claims that the defendant allegedly manufactured and sold chainsaws with a design defect. After defendant’s motion to dismiss was denied, plaintiff sought discovery that included the PI of customers who had complained about the purported product defect (including individuals in California). The defendant resisted production of this information, in reliance on the CCPA. Specifically, the defendant argued that the CCPA expanded the privacy rights previously provided under California law. As such, the defendant argued that the court should “protect the consumers’ PI by allowing consumers an opportunity to opt out from disclosure.” The defendant claimed this approach was consistent with the CCPA’s notice and consent requirements.
The magistrate judge overseeing the case rejected defendant’s proposed limitation on discovery. The court acknowledged that the CCPA “presents some additional privacy concerns as recognized by the California state legislature’s enactment of the statute.” That being said, California law has historically recognized certain privacy protections for personal identifying information. And these protections have been balanced against the right of civil litigants to discovery. In light of this historical approach, the magistrate judge found that any privacy concerns implicated by this case could be addressed through a protective order. The court granted plaintiff’s motion to compel, stating that, “[n]othing in the CCPA presents a bar to civil discovery. Notably, no other case has so held. And the statute itself explicitly says that it is not a restriction on a business’s ability to comply with federal law.”
So there you have it. While the court in Will Kaupelis rejected the CCPA as a basis for limiting discovery, the production of PI is a reoccurring issue in litigation (including in contexts other than the CCPA). Stay tuned.
