Insights
Publications

Data Scraping Under the Revised CCPA Regulations

March 18, 2020 Blog

On March 11, 2020, California Attorney General Xavier Barrera released a second revision to the draft California Consumer Privacy Act (CCPA) regulations. The new draft contains a number of important changes to the regulatory landscape under the CCPA. One very specific change—concerning data scraping—caught my eye. Since the CCPA has been discussed and, indeed, even earlier in connection with the GDPR, there has been an open question of whether entities that pull personal data from public sources (e.g., from the publicly available LinkedIn pages) were required to provide notice to the individuals whose data had been collected. The new regulations answer the question, at least in part.

Specifically, §999.305(d) as revised provides that “[a] business that does not collect personal information directly from a consumer does not need to provide a notice at collection to the consumer if it does not sell the consumer’s personal information.”

Thus, a data scraper who does not sell the scraped information would not have to provide notice at collection. Where the company scrapes information for its own use, even to market to the identified consumers, it would not have to provide notice. My Farella colleague, Deepak Gupta asked “what if they collect the data, de-identify it, and sell the de-identified collection of data?” As the regulations are currently written, such a business is not subject to the notice requirements because it is not selling collections of personal information.”

On the other hand, a scraper that creates and sells collections of scraped data including personal information would not be exempted from the reporting requirement, and would need to provide notice “at collection,” though it is still not clear what that specifically means. That is, what is the timing of such notice and what form does it need to take? What would happen, for example, if a scraper that sells such collections of personal information does not collect any contact information? Would that data scraper be required to scrape contact information as well?

Not surprisingly, there are still questions to be answered. Of course, these regulations are still not final, so we could get more answers as we go forward. And more questions.

Firm Highlights

Publication

New CCPA Lawsuit Against Zoom: Issues to Watch

As large portions of society become subject to coronavirus-related quarantines, increasing numbers of people have turned to web-based communications platforms for classes, meetings, events, and socialization. One such platform, Zoom, has become, in some...

Read More
Publication

Public Ends From Private Means: Privacy Rights and Benevolent Use of Personal Data

With the explosion of COVID-19 cases worldwide, companies and governments have expanded their interest in the use of the vast stores of consumer data. Even where such collection and use of personal data is ostensibly...

Read More
Publication

Trademark Office Deadlines and Coronavirus-Related Delays

With all of the business interruption caused by the COVID-19 pandemic, many worldwide trademark offices have taken steps to recognize the issues caused by the crisis. The offices in which applicants from the U.S...

Read More
Publication

Force Majeure and Contractual Non-Performance During the Coronavirus Pandemic

Never in the experience of most of us has an event so thoroughly interrupted business as usual as the coronavirus (COVID-19) pandemic. Everywhere, contract parties facing severe stress in their businesses are reassessing their contractual...

Read More
Publication

What California’s New Security Law Means to Your Business

Commonsense IoT security steps that startups and small business should consider to comply with California’s new law California recently enacted a new law, Senate Bill 327, that requires companies that make Internet of Things...

Read More
News

GDPR in 2020: What You Need to Know

In the article "GDPR in 2020: What You Need to Know," Nate Garhart discussed the newly clarified guidelines for extraterritorial application of GDPR. Read the full article on Toolbox , here .

Read More
Publication

CCPA Enforcement During COVID-19 Pandemic

The California Consumer Privacy Act (CCPA) that went into effect on January 1, 2020 provided for a grace period to allow companies additional time to come into compliance with the new regulation.  That grace...

Read More
Publication

Going it Alone: How to Manage Cybercrime Response With Less Government Help

By: Jessica K. Nall, Chair, White Collar Defense and Corporate Investigations practice and Aviva J. Gilbert, Senior Associate, White Collar Defense and Corporate Investigations practice, Farella Braun + Martel [1] Several years ago when...

Read More
Publication

Is your company covered by California's new privacy law?

Privacy image
Read More