The California Consumer Privacy Act of 2018 (CCPA) comes into force on Jan. 1, 2020. The CCPA enshrines the “right of Californians to know what personal information is being collected about them,” and “to access their personal information” after it is collected.

The Act confers no generalized private right of action. The CCPA does not directly modify any rule of evidence or civil procedure. Indeed, the Act acknowledges that the obligations to produce information under the Act, “shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law,” Cal. Civ. Code 1798.145(b).

Nevertheless, the plaintiffs' bar may attempt to use the access provisions of CCPA as a tool in their discovery arsenal. Litigators and compliance attorneys must work together against the rush to exploit the CCPA for liability purposes.

The CCPA Will Create Honeypots of Personal Information

The CCPA imposes obligations on any business which collects and/or processes “personal information” about “consumers” and meets certain additional financial criteria. In practice, a great many companies that operate in California or nationwide will be subject to the Act.