Privacy, Pricing, and the Value of Consumer Data: the Complex Nature of the Ccpa's Non-discrimination Requirement

• Jurisdiction: California,United States
• Author: By Jeewon Kim Serrato and Lawrence Wu
• Publication year: 2020
• Citation: Vol. 30 No. 2

PRIVACY, PRICING, AND THE VALUE OF CONSUMER DATA: THE COMPLEX NATURE OF THE CCPA'S NON-DISCRIMINATION REQUIREMENT

By Jeewon Kim Serrato and Lawrence Wu¹

I. INTRODUCTION

Much like how there was debate in the past on whether the goals of antitrust and intellectual property law were incompatible or complementary,² we should anticipate many debates on how the goals of privacy law may affect the way firms compete, particularly when consumers are given a choice of opting in or opting out of providing companies with their personal information and when those choices may be affected by the prices charged and the services offered by those companies. With the passage of the California Consumer Privacy Act (CCPA),³ which went into effect on January 1, 2020, this issue is now front and center.

The CCPA is a first-of-its-kind law that requires businesses to calculate the value of consumer data. While it includes several new consumer rights, such as the right to know, right to delete, and a right to opt-out, this article will focus on the right to non-discrimination and the complexities that businesses will face as they navigate three things: the need to ensure consumers' right to privacy and non-discrimination under the CCPA; the ability to offer competitive prices and marketing incentives to meet consumer demands; and the opportunity to earn revenue from the consumer data they may be able to collect, sell, and retain. These three interrelated objectives complicate what businesses may have to do to meet one of the fundamental requirements under the CCPA, which is this: if a business offers financial incentives or a price or service difference as compensation for the collection, sale, or retention of consumer data, the business must explain how the incentives or price or service difference are reasonably related to the value of the data to the business. This is uncharted territory; and while we wait to see what enforcement actions the California Attorney General brings under this law, which began on July 1, 2020, we cannot underestimate the lasting impact the law may have on the global privacy discourse and how regulators view the respective rights and powers the consumers and businesses have in controlling the use of personal data that is collected about individuals.

II. THE RIGHT TO NON-DISCRIMINATION UNDER THE CCPA

One of the most groundbreaking aspects of the CCPA is the notion that consumers have a right to non-discrimination, under which businesses are prohibited from discriminating against consumers who exercise their privacy rights, such as the right to know, delete, or opt-out of the sale of their personal information. To comply with the CCPA, businesses must include a statement in their privacy policies informing consumers that they have a right "not to receive discriminatory treatment" for exercising their CCPA rights.

[Page 100]

While the CCPA does not define what it means to "discriminate," it provides a nonexclusive list of practices that may qualify as discriminatory, which includes responding to a consumer by:

• Denying goods or services;
• Charging different prices;
• Providing a different quality of goods or services; and
• Suggesting that the consumer may receive a different price or rate.⁴

Because enforcement of the CCPA has only begun on July 1, 2020, we have yet to see how the Office of the Attorney General of the State of California (OAG), which has the sole authority to bring an enforcement action under the law, interprets this provision. According to the Frequently Asked Questions that were published by the OAG, "Businesses cannot deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your rights under the CCPA."⁵ This does not mean, however, that consumers have an unlimited right to non-discrimination without consequences. The OAG provides two examples of potential consequences: (1) "if you refuse to provide your personal information to a business or ask it to delete or stop selling your personal information, and that personal information or sale is necessary for the business to provide you with goods or services, the business may not be able to complete that transaction";⁶ or (2) "[i]f you ask a business to delete or stop selling your personal information, you may not be able to continue participating in the special deals they offer in exchange for personal information."⁷ Not being able to complete the requested transaction or not allowing customers to participate in special deals, however, are often not the desired outcome for businesses, so how can businesses offer promotions, discounts and other deals in exchange for collecting, keeping or selling your personal information?

The CCPA provides certain exceptions to the general prohibition on discrimination. Businesses may charge different prices or offer different levels of service if the difference is "directly related to the value provided to the business by the consumer's data."⁸ The CCPA also permits businesses to offer financial incentives—including payments to consumers as compensation for the collection, sale, or deletion of personal information—as long as the programs are not "unjust, unreasonable, coercive, or usurious in nature,"⁹ and if businesses notify consumers of these financial incentives, obtain opt-in consent prior to enrolling a consumer in a financial incentive program, and provide consumers with the opportunity to revoke consent for such programs at any time.¹⁰

[Page 101]

This has generally been interpreted to mean that the CCPA was intended to allow businesses to offer tiered pricing or service levels so long as the financial incentive or price or service difference is reasonably related to the value of the consumer's data. However, any business that is seeking to rely on this exception must first calculate a good-faith estimate of the value of the consumer's data or show that the tiered pricing or service levels are reasonably related to the value of the consumer's data. For example, this means companies need to prepare a good faith estimate of the value of the data that is the basis for the financial incentive, price difference, product difference, or service difference that they may offer to consumers in order to incentivize them to not exercise their right to opt-out from the sale of their personal information. Companies will also need to describe the methodology they are using to calculate that value.

III. "CONSUMER," "PERSONAL INFORMATION," AND "SALE" UNDER THE CCPA

In order for a business to understand when this non-discrimination right may be triggered and to calculate the value of the personal data, it must first understand the key terms under the CCPA which are defined broadly and may be different than what most people expect. Again, there have not been any enforcement actions that provide guidance on how each of these terms should be interpreted and applied in practice.

First, the term "consumer" under the CCPA generally means "a natural person who is a California resident."¹¹ Thus, CCPA requirements should only apply to California residents. However, it is possible that questions may arise relating to the applicability of the law to persons who lived in California only part of the time, California residents whose information was collected before they were California residents but continue to be processed after they have moved to California, and to what extent the legal requirements would apply to data that belong to California residents but collected outside of California. Even if we have determined that CCPA does not apply to a specific data processing activity, over a dozen states are contemplating CCPA-like laws and thus the concept of non-discrimination may be extended to other jurisdictions. Businesses that do not segment their data based on geographic locations or based on the time of collection may also face challenges in determining what data is in scope under the CCPA or other consumer privacy laws that are jurisdiction-specific.

Second, "personal information" under the CCPA is defined as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household."¹² This is a very broad definition of what may constitute personal information and therefore protected under the law. For instance, information such as behavioral analytics and inferences based on interaction with websites which are used to create profiles about a consumer reflecting the consumer's preferences may be in scope. In contrast, the CCPA's definition of "personal information" does not include information lawfully made available from federal, state, or local government records, which the OAG acknowledges are often sources used by data brokers.¹³

[Page 102]

Third, the terms "sell," "selling," "sale," or "sold," are defined as "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to another business or a third party for monetary or other valuable consideration."¹⁴ Because of this broad definition, even transfers that do not involve a financial payment could constitute a sale under the CCPA. Most companies don't sell their data for money, but they may engage in bulk data sharing for product improvement or inventory control. In order for data transfers to not be considered as a "sale," businesses can rely on the "business purpose" exception. Specifically, a business can use the personal information for the business's or a service provider's operational purposes, or other notified purposes, provided that "the use of personal information shall be reasonably necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another...