There are many facets to California’s new data privacy law, the California Consumer Privacy Act of 2018 (CCPA), that are generating a lot of buzz — such as the new rights afforded to California consumers and the broad definition of personal information. There is an equally impactful, yet often forgotten, obligation required by the CCPA that warrants attention. That is the need to make certain representations in written contracts between covered businesses and service providers.

The CCPA generally impacts three types of entities: (1) covered businesses; (2) service providers; and (3) third parties. There are certain advantages to being considered a service provider over a third party. For instance, if a business shares personal information with a third party, that can trigger certain disclosures that must be made to the consumer. See Cal. Civ. Code § 1798.110(a)(4). Likewise, third parties must provide notice to consumers before “selling” personal information they receive to others (as that word is broadly defined in the CCPA), as well as a mechanism by which consumers can exercise their newfound right to opt out. See Cal. Civ. Code §§ 1798.115(d), 1798.120(a). Any one of these obligations could prove costly for an entity to implement in practice depending on the circumstances.

Transferring personal information to a service provider, by contrast, does not necessarily trigger those additional obligations. But an entity cannot simply call itself a service provider. There are certain thresholds that must be met as set forth in the statute.

First, there must be a written contract in place between the covered business and the service provider, such as a service agreement. See Cal. Civ. Code § 1798.140(v). The absence of any agreement or written contract is a strong indication, if not concrete proof, that the entity receiving the personal information is a third party.

Second, the written contract must include certain representations. The CCPA requires the written contract to state that the service provider will not retain, use, or disclose the personal information for any purpose other than for the specific purpose of performing the services set forth in the contract. SeeCal. Civ. Code § 1798.140(v). The parties must further agree to limit the collection, sale, or use of the personal information disclosed except as necessary to perform the “business purpose” for which the service provider was retained. See Cal. Civ. Code § 1798.140(w)(2). The CCPA anticipates that the “business purpose” will relate to a covered business’s “operational” needs, such as auditing, detecting security incidents, fulfilling orders and transactions, processing payments, etc. See Cal. Civ. Code § 1798.140(d). Finally, the parties must represent that they have read and understand the CCPA’s requirements. See Cal. Civ. Code § 1798.140(w)(2).

Third, those representations must be accurate. A company that receives and uses personal information for reasons beyond the operational needs of the covered business will likely be considered a third party, regardless of the representations in the written contract. Where that is unavoidable, the company must be sure to weigh the benefits of processing the personal information against the risks of being considered a third party and the costs of additional CCPA compliance.

In situations where these representations can be made and are accurate, they are simple enough to implement and could be low-hanging fruit for a business looking to demonstrate CCPA compliance by January 1, 2020. Following the passage of the European Union’s General Data Protection Regulation (GDPR), many U.S.-based businesses have been forced to enter into data processing agreements (DPAs) to supplement existing service agreements. While the CCPA does not necessarily require a DPA, more and more companies’ global privacy compliance programs are requiring one to do business. In those instances, it may make the most sense to include these representations in the DPA itself. Otherwise, a business could include them in a stand-alone addendum to its existing written service contracts.