The California Privacy Protection Agency (CPPA) issued its first enforcement advisory concerning the California Consumer Privacy Act (CCPA). In Enforcement Advisory No. 2024-01, the CPPA tackles a foundational principle – data minimization. Much of the attention surrounding the CCPA seems to focus on website privacy policies, notices at collection, and consumer rights requests. With its inaugural advisory directed at data minimization, the CPPA may be reminding covered business, service providers and others that CCPA compliance requires a deeper review of an organization’s practices concerning the collection, use, retention, and sharing of personal information.

First, a word on CPPA “Enforcement Advisories.” Being the first of its kind for the CCPA, we thought it would make sense to convey what the agency noted about these advisories :

Enforcement Advisories address select provisions of the California Consumer Privacy Act and its implementing regulations. Advisories do not cover all potentially applicable laws or enforcement circumstances; the Enforcement Division will make case-by-case enforcement determinations. Advisories do not implement, interpret, or make specific the law enforced or administered by the California Privacy Protection Agency, establish substantive policy or rights, constitute legal advice, or reflect the views of the Agency’s Board.

Based on this language, while it appears that an enforcement advisory will not provide a compliance safe harbor, there are valuable insights to be gained concerning the potential application of the CCPA.

For any organization concerned about data risk, data minimization is certainly one way to mitigate that risk. Most organizations work diligently to design and build information systems that prevent unauthorized access to those systems. But, when that unauthorized access happens, and it does, the data is compromised. If there is less of that data in the compromised system, risk has been mitigated, even if not eliminated.

The concept of data minimization did not originate with the CCPA. For example, under HIPAA, covered entities and business associates must comply with the minimum necessary rule. According to the CPPA:

Data minimization serves important functions. For example, data minimization reduces the risk that unintended persons or entities will access personal information, such as through data breaches. Data minimization likewise supports good data governance, including through potentially faster responses to consumers’ requests to exercise their CCPA rights. Businesses reduce their exposure to these risks and improve their data governance by periodically assessing their collection, use, retention, and sharing of personal information from the perspective of data minimization.

The process of achieving data minimization can be challenging as it does not lend itself to a one-size fits-all approach. Under the CCPA, businesses must apply the data minimization principle “to each purpose for which they collect, use, retain, and share consumers’ personal information—including information that businesses collect when processing consumers’ CCPA requests.” As noted in the Enforcement Advisory, there are many obligations under the CCPA for which data minimization must be considered and applied, such as requests to opt-out of the sale or sharing of personal information, or requests to limit the use and disclosure of sensitive personal information. Of course, even the collection of personal information by a business must be “reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed.”

Applying this foundational principle, according to the Enforcement Advisory, essentially amounts to asking questions about the particular collection, use, retention, and sharing of personal information. In one example, the Advisory discusses how to apply data minimization to the process of verifying a consumer’s identity to process a request to delete personal information. It offers the following questions as examples of what a business might ask itself:

• What is the minimum personal information that is necessary to achieve this purpose (i.e., identity verification)?
• We already have certain personal information from this consumer. Do we need to ask for more personal information than we already have?
• What are the possible negative impacts posed if we collect or use the personal information in this manner?
• Are there additional safeguards we could put in place to address the possible negative impacts?

Considering the CCPA’s rules for verification and the needs of the business for that personal information, the business should make decisions for the verification process with minimization in mind. Further, minimization is something that should be periodically assessed.

The need to apply the principle of data minimization makes clear that CCPA compliance is more than posting a privacy policy on the business’s website. It requires, among other things, that businesses think carefully about what categories of personal information they are collecting, the sensitivity of those categories of personal information, the purpose(s) of that collection, and whether the information collected is minimized while still serving the applicable purposes.