The Consumer Finance Observer – Winter 2021 Edition
Total Page：16
File Type：pdf, Size：1020Kb
The Consumer Finance Observer A periodic update on legal developments in consumer finance Winter 2021 Edition The Consumer Finance Observer A periodic update on legal developments in consumer finance — Winter 2021 Edition IN THIS ISSUE: PAGE 1 California Passes Proposition 24: California Privacy Rights Act to Become Law Class Actions Seek to Test the Limits of the CCPA’s Private Right of Action PAGE 4 California Passes Proposition 24: California Legislature California Privacy Rights Act to Passes New Consumer Become Law Financial Protection Law By: David P. Saunders, Kate T. Spelman, and Effiong K. Dampha Is Betting on an Athlete’s Heart Rate During a Game Privacy was on the ballot this past November, the most significant changes, which we have Coming to Broadcasting? at least in California. And it appears that enough written about previously. Those changes include people voted in favor of Proposition 24, the handling a new category of “sensitive personal PAGE 5 California Privacy Rights Act (CPRA), for it to information,” the expansion of the existing Colorado Consumers become law. Although the CPRA technically CCPA private right of action, and mandatory Receive Additional becomes effective five days after the California changes to company privacy policies. So what Secretary of State certifies the voting results, happens to the CCPA, and what do businesses Protections after Attorney the bulk of the law – which is an overhaul of have to prepare for? The answer is not much in General Settles Lawsuits the California Consumer Privacy Act (CCPA) – the short term. will not come into force until January 1, 2023. PAGE 6 Continued on top of next page Businesses have some time to prepare for Three Takeaways from LendIt 2020 SEC and CFTC Actions Against Cryptocurrency App Developer for Class Actions Seek to Test the Limits Unregistered Security- of the CCPA’s Private Right of Action Based Swaps Highlight Risks By: Kate T. Spelman, Vivian L. Bickford, and Effiong K. Dampha for FinTech Companies The California Consumer Privacy Act (CCPA) The CCPA also includes what was supposed to PAGE 8 took effect January 1, 2020. As has been well be a limited private right of action that permits Funds Travel Rule documented, the statute provides consumers consumers to recover up to $750 in statutory Compliance Obstacles damages per incident when certain types of with certain rights regarding their personal Facing Crypto Firms personal information are exposed in connection information, including the right to know whether with a data breach. Perhaps unsurprisingly, this PAGE 10 businesses are collecting such information and private right of action has already spawned EDPB Provides Guidance how it is being used, the right to request deletion dozens of class actions in California state and on Personal Data Transfers of such information, and the right to opt out of federal courts. These suits shed light on the Following Schrems II the sale of such information to third parties. Continued on bottom of next page The Consumer Finance Observer Winter 2021 Edition | 2 Continued from previous page – California n A Consumer Privacy Fund will be created n A new state agency, the California Privacy Passes Proposition 24: California Privacy Protection Agency, will be created, Rights Act to Become Law – with appropriations to be made by the legislature – with the purpose of funded, and begin operations. Until the CPRA becomes fully effective in 2023, “offsetting the costs” of state courts and the CCPA remains in full effect. That means Because of the phased effective dates for CPRA’s businesses should keep up with their CCPA the California Attorney General enforcing provisions, businesses have time to revise their compliance, including being attentive to new the CCPA (and later the CPRA). The fund policies and prepare for the full weight of the California Attorney General regulations. The will also be used “to promote and protect CPRA. Of course, that does not account for following CPRA provisions – which largely do consumer privacy, educate children whatever CPRA regulations the California not impact businesses directly – will become in the area of online privacy, and fund Attorney General publishes, which we expect effective once the California Secretary of State cooperative programs with international to be previewed perhaps as early as late 2021. certifies the voting results. law enforcement organizations” in n An extension of the carve out for connection with addressing consumer business contact and employee personal data breaches. information that is collected by businesses covered by the CCPA. In the existing n The California Attorney General will be CCPA, these carve outs were set to charged with developing a laundry list of expire on January 1, 2021. The carve outs new regulations, which will put meat on will now be extended to January 1, 2023. the bones of many of the new CPRA rules. Continued from previous page – Class Actions Seek to action applies only to the “unauthorized access For example, in L.P. v. Shutterfly, which was filed Test the Limits of the CCPA’s Private Right of Action and exfiltration, theft, or disclosure” of personal in the Northern District of California on July 23, various ways plaintiffs are testing the boundaries information resulting from a business’s failure to several minor plaintiffs and their legal guardians of the CCPA and its private right of action. “implement and maintain reasonable security assert a CCPA claim based on Shutterfly’s alleged Several categories of boundary-testing CCPA procedures and practices.” Importantly, CCPA collection and use of minors’ personal biometric lawsuits are discussed below. claims “based on violations of any other section information without notice and an opportunity of this title” are not permitted. Despite this for deletion in violation of Section 1798.100(b) CCPA LAWSUITS PREMISED express limitation, a number of plaintiffs have of the CCPA. The complaint also seeks to hold ON VIOLATIONS OF THE asserted CCPA claims based on alleged failures Shutterfly liable for selling minors’ personal to comply with the CCPA’s disclosure, deletion, STATUTORY NOTICE AND biometric information without requiring opt-in and opt-out requirements. While these alleged OPT-OUT PROVISIONS or parental consent, and attempts to equate this failures may constitute technical violations of conduct to “a data breach” under CCPA Section As mentioned above, the CCPA provides the CCPA, under a plain reading of the statute, 1798.150. If adjudged viable, this claim would consumers with certain rights to know and they do not give rise to a private right of action. render meaningless the prohibition against CCPA control how their data is being collected and Nonetheless, plaintiffs have not been deterred claims based on violations of the disclosure and used. However, the CCPA’s private right of from bringing suit. opt-out provisions of the statute. Shutterfly has not yet responded to the complaint. Similarly, in McCoy v. Alphabet, which was filed in the Northern District of California on August 5, the plaintiffs allege that Google violated Section 1798.100(b) of the CCPA by failing to disclose that it collects plaintiffs’ “sensitive personal data from non-Google apps, including the duration of time spent on non-Google apps and the frequency that non-Google apps are opened.” Google’s pending motion to dismiss argues that the plaintiffs’ CCPA claim should be dismissed because it is premised on statutory violations to which the private right of action does not apply. Continued on bottom of next page The Consumer Finance Observer Winter 2021 Edition | 3 Continued from previous page CCPA LAWSUITS STRETCHING CCPA LAWSUITS SEEKING THE DEFINITION OF RECOVERY FOR NON- ‘PERSONAL INFORMATION’ CALIFORNIA RESIDENTS The CCPA contains a broad definition of “personal information” subject to its notice and The CCPA applies only to “consumers” who opt-out requirements. The CCPA’s private are “California resident[s].” Yet, several pending right of action, on the other hand, only covers CCPA class actions seek recovery for or on data breaches involving the more narrow behalf of non-California residents. Fuentes v. definition of “personal information” in California available, telephone numbers and addresses. Sunshine Behavioral Health Group LLC, filed Civil Code § 1798.81.5(d)(1)(A). Under that There is no allegation, however, that the in the Central District of California on March statute, “personal information” must include breach resulted in the exposure of consumers’ 10, is representative of these actions. There, a consumer’s first name or first initial and last names in conjunction with the type of sensitive a Pennsylvania resident filed a CCPA claim on name “in combination with” unencrypted information required by the relevant statutory behalf of a nationwide class of alleged victims sensitive information such as the consumer’s provision on which the CCPA’s private right of of a California company’s data breach. The Social Security number, driver’s license number, action relies. No substantive motions have been defendant filed a motion to compel arbitration financial information, medical information, health filed to date, though Minted has indicated that it or, in the alternative, to dismiss the complaint, insurance information, or unique biometric intends to file a motion to compel arbitration. in which it argued, among other things, that the data. However, several CCPA class actions Companies doing business in California should CCPA claim must be dismissed because the seek recovery for the allegedly unauthorized expect to see these boundary-testing CCPA non-resident plaintiff is not a “consumer” under disclosure of information that does not appear class actions continue until courts weigh in the statute. The court has not yet ruled on the to meet this statutory definition. motion. on this unsettled area of law. Until then, and Atkinson v. Minted, filed in the Northern District in any event, businesses should take steps to McCoy is also illustrative of this category of CCPA of California on June 11, provides an example implement adequate security procedures, and lawsuits.