By David A. Zetoony, a Partner in the Boulder, CO office of Bryan Cave Leighton Paisner LLP, where he Chairs the Global Data Privacy and Security Team, and Anne Redcross Beehler, an Associate in the firm’s Irvine, CA office.
The hastily drafted California Consumer Privacy Act (CCPA) raises serious issues concerning the attorney-client privilege, work-product doctrine, and client confidentiality. The CCPA contains extremely unclear provisions on an attorney’s obligations to maintain client confidentiality and privilege. Without further clarification from the legislature or the California Attorney General’s rulemaking process, this lack of clarity is likely to lead to litigation.
The CCPA confers an obligation upon businesses (a term that could apply to many law firms and their corporate clients depending upon the factual circumstances) to provide privacy notices to individuals about whom information is collected, to provide individuals with access to information held about them, and, in some instances, to delete information about individuals upon their request. As currently written, the CCPA contains an exemption that states that the “obligations imposed on businesses by Sections 1798.110 to 1798.135 [of the CCPA], inclusive, shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law . . . .” While the legislature presumably intended to ensure that the CCPA did not require a business or its outside counsel to disclose privileged information, on its face the exemption is limited only to the obligations imposed by “Sections 1798.110 to 1798.135.” It expressly does not apply to obligations imposed by other sections, such as §§ 1798.100 or 1798.105.
Sections 1798.100 and 1798.105 are particularly relevant when it comes to attorney-client privilege, work-product, and client confidentiality. Section 1798.100 contains within it the requirement that a business must, in response to an access request, “provide” to a consumer “specific pieces of personal information the business has collected” about the individual. Section 1798.105 contains within it the requirement that a business must, in response to a valid deletion request, “delete the consumer’s personal information from its records. . . .” The net result is that the statute does not on its face prevent a California resident from requesting that an attorney or a business disclose privileged, work-product, or confidential information that relates to the California resident, nor does it prevent the California resident from requesting that a law firm (or its client) delete privileged information that relates to the individual.
Other more general exemptions to disclosure in the CCPA could arguably apply, although it is unclear whether the legislature intended that these exemptions cover privileged, work-product, and confidential information of a client. For instance, § 1798.145(j) states that none of the “rights afforded to consumers and the obligations imposed on the business” should “adversely affect the rights and freedoms of other consumers,” while § 1798.145(a)(1) provides “the obligations imposed on businesses by this title shall not restrict a business’s ability to … [c]omply with federal, state, or local laws.” A business or law firm faced with the question of whether it must disclose privileged, work-product, or confidential information may turn to these sections to argue that the CCPA should not supersede other state laws concerning privilege, work-product, or an attorney’s ethical obligations to maintain client confidentiality. However, a consumer seeking disclosure of the information may conversely argue the more specific should govern over the general. Because the specific exemption concerning evidentiary privileges (such as privilege) expressly does not apply to all sections of the CCPA, so the argument goes, these other more general exemptions should not apply either.
To avoid a harsh result in which privilege and client confidentiality is compromised, interested parties are encouraged to communicate their concerns to the California Attorney General or the state legislature. Without clarification through further legislation or rulemaking, the courts will be forced to decipher the legislative intent behind the hastily drafted statute.