AB 874, 1355: Narrowing the definition of ‘personal information’ under CCPA

On Oct. 11, Gov. Gavin Newsom signed five bills amending the California Consumer Privacy Act of 2018, effective as of Jan. 1. Two of them, Assembly Bills 874 and 1355, taken together, were welcomed relief by businesses everywhere because they narrowed the definition of "personal information" and thus the reach of the CCPA.

In defining "personal information," the CCPA always excluded "publicly available" information, i.e., information lawfully made available from federal, state or local government records. However, the CCPA originally limited this exclusion, stating that information is not "publicly available" if the data is used for a purpose that is not compatible with the government's purpose in maintaining that information and making it available to the public in its records. AB 874 removed this carve out from the "publicly available" information exclusion, making the law more clear and enabling consistent application.

The carve out created ambiguity and practical problems. It is unclear how any business could determine with any accuracy a government entity's purpose for maintaining or making publicly available its records. Further, the undefined term "compatible" invites inconsistent application in determining whether a business's use of publicly available government records triggers the CCPA.

AB 874 and AB 1355 also corrected an error in the original text of the CCPA, clarifying that "personal information," rather than "publicly available" information, does not include consumer information that is deidentified or aggregate consumer information. The amendments, taken together, make clear that once information can no longer reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer (i.e., "deidentified information"), or information that relates to a group or category of consumers, from which individual consumer identifiers have been removed (i.e., "aggregate consumer information"), such information is no longer "personal information" subject to the CCPA.

While many applaud California for enacting sweeping consumer privacy legislation, these amendments maintained an important balance of certainty for business owners as well as the public's interest in the free flow of information from publicly available government records. For example, a business should be able to use real estate data available from a county recorder's office, and publish it on websites frequented by home buyers and sellers looking for sales history, lot size, square footage, property taxes and other data relating to residential property.

Though many businesses would have welcomed more amendments to further narrow the scope of the CCPA, while continuing to provide consumers greater control of the handling of their personal information, there is much gratitude for the exceptions created by AB 874 and AB 1355 to the scope of personal information and the CCPA.

Stephanie Sparks is the chair of Hoge Fenton's Privacy & Data Security practice group, now in its 12th year, advising companies operating globally on privacy laws and industry information security requirements.