July 5, 2019
A Trip Down the Rabbit Hole
The California Consumer Privacy Act (CCPA) drastically alters how companies are required to handle personal information. It also gives California consumers new rights to access and delete their data. In an earlier blog, we explored the fundamental question of what qualifies as personal information under the CCPA. In this article we explore a question that is equally important to answer in order to understand how the CCPA works and who it applies to: What does the CCPA mean when it uses the term “consumer?” Let’s start with English author Lewis Carroll.
Among the many words and phrases the author is credited with introducing into the English language is “rabbit hole.” Specifically, Carroll famously illustrated how a person could fall down a rabbit hole, as Alice does at the beginning of her story. The CCPA’s definition of consumer is a classic rabbit hole, and in this article, we explore every burrow, chamber, and passage shooting off from the main definition.
Consumer in the CCPA
In the text of the CCPA, a consumer is described as “a natural person who is a California resident, as defined in Section 17014 of Title 18 of the California Code of Regulations . . . however identified, including by any unique identifier.” 1798.140(g) (emphasis added). Therefore, when the CCPA refers to consumers, it is referring specifically to California consumers. However, all Californians who meet the residency and domicile requirements (see below) are considered consumers. Even when they are not acting as such.
First rabbit hole: Who qualifies as a California resident?
Section 17014 of Title 18 of the California Code of Regulations (CCR) explains that the term “resident” includes:
“(1) every individual who is in the State for other than a temporary or transitory purpose, and (2) every individual who is domiciled in the State who is outside the State for a temporary or transitory purpose. All other individuals are nonresidents.”
Under this definition, a person does not have to be domiciled in California in order to be a resident if they are in the State for “other than a temporary or transitory purpose.” Likewise, even if individuals are domiciled in the state, they may not be residents if they are outside California for a long or indefinite period of time. These observations reveal two more questions that are important to understanding the nuances of who counts as a consumer under the CCPA.
1. Temporary or Transitory Purposes
What counts as a “temporary or transitory purpose? Section 17014(b) of the CCR explains that
Whether or not the purpose for which an individual is in this State will be considered temporary or transitory in character will depend to a large extent upon the facts and circumstances of each particular case. It can be stated generally, however, that if an individual is simply passing through this State on his way to another state or country, or is here for a brief rest or vacation, or to complete a particular transaction, or perform a particular contract, or fulfill a particular engagement, which will require his presence in this State for but a short period, he is in this State for temporary or transitory purposes, and will not be a resident by virtue of his presence here.
If, however, an individual is in this State to improve his health and his illness is of such a character as to require a relatively long or indefinite period to recuperate, or he is here for business purposes which will require a long or indefinite period to accomplish, or is employed in a position that may last permanently or indefinitely, or has retired from business and moved to California with no definite intention of leaving shortly thereafter, he is in the State for other than temporary or transitory purposes, and, accordingly, is a resident taxable upon his entire net income even though he may retain his domicile in some other state or country
(emphasis added).
Okay, so the answer this section gives upfront is . . . it depends. But Section 17014(b) does give some guidance on what it might depend on, namely definiteness and length. People who are temporarily in the state for a short, definite period of time are probably not residents; those who are in California for an indefinite or long amount of time probably are residents, both for the purposes of taxes and the rights and restrictions that are a part of the CCPA.
Furthermore, the note accompanying Section 17014(b) outlines a few more helpful guideposts. An individual might be considered in the State for temporary or transitory purposes if he:
- is not in California more than six total months out of the year;
- is domiciled in another state;
- maintains a permanent abode at the place of his domicile;
- and does not engage in any activity or conduct in California other than that of a seasonal visitor, tourist, or guest.
For specific illustrations of what this type of conduct might look like, check out the examples included in the text of the law here.
2. Domicile
The second question raised by the CCR’s definition of a resident is “When is someone considered ‘domiciled’ in California?” Thankfully, Section 17014(c) of Title 18 of the CCR has an answer for that as well. Domicile is “the place where an individual has his true, fixed, permanent home and principal establishment” and where that person intends to return to if they are absent. Importantly, the section clarifies that no one can have more than one domicile at the same time. Check out the link to Section 17014 above if you want to read through some examples of what domicile looks like.
Students present the perfect case for determining how to identify a California resident. Students coming in from out of state are coming in with the intent to stay for a relatively long period, but many of them intend to return to their original state of residence and maintain that residence as their primary domicile.
For the purposes of a company deciding whether to honor a consumer request, these are involved questions. As part of the verification process when consumer requests are received, the most efficient method would be to ask consumers whether they reside in California with the intent to stay there and accept their response as accurate.
Second Rabbit Hole: Consumer Activity not Required
Although the CCPA is written specifically in order to protect California consumers—as the name of the law itself tells us—the text of the law never makes a distinction between individuals in their capacity as consumers and otherwise. According to the CCPA, all Californians, in all of their capacities, are consumers under the CCPA.
Therefore, if I, a California resident, fill out a job application for a company that is regulated by the CCPA, I am then able to go onto that company’s website or call their toll free number and demand a deletion of my personal information because I am a California consumer. I could also request a report of the personal information they had collected about me.
A number of businesses, especially those that do no deal in what is traditionally construed as consumer information but do collect employment information for California residents, have lobbied to push through an amendment to the law. Assembly Bill 25, which has already passed the California Assembly and is now before the Senate, would change the CCPA so that it does not cover personal information obtained from job applicants, employees, contractors, or agents when they are acting in those capacities. One of the amendment’s sponsors, California Assembly member Ed Chau, has noted that the amendment is designed so that “where the person’s ‘employee hat’ is on, the CCPA rights do not apply. Where the same person’s ‘employee hat’ is off, the CCPA applies.” If AB 25 does not pass, a number of businesses will have to come into compliance with the CCPA specifically because of the employee data they collect.
Lingering Questions
So, what are some basic considerations that come out of the CCPA’s definition of consumer? For one, a business, even one that relies heavily on the collection and processing of consumer data, should not try to be overly stringent in determining which consumers qualify as California residents. This would be a costly and time-consuming process with a high margin of error due to the actual intent element involved in determining a person’s residency.
For those businesses that are collecting personal information about the employees, job applicants, contractors, and agents who are also California consumers, they should watch AB 25. If it does not pass, those companies will need to ensure that their internal CCPA consumer request procedures include a process for determining which employee information is not subject to deletion requests despite the CCPA. For example, some applicant and employee information must, by law, be kept for a certain number of years under EEOC and OSHA regulations, which would exempt that information from a CCPA deletion request. (See our posts on data retention policies and CCPA exemptions for more information.)
***DISCLAIMER: This publication has been prepared by SixFifty, LLC to provide information of interest to our readers regarding the California Consumer Privacy Act. It is not intended to provide legal advice for a specific situation or to create an attorney-client relationship. SixFifty, LLC does not provide legal advice.***
