Right to Opt-Out of Sale

00:01

Hello, everyone and welcome to less than 3.5. As we discuss the right to opt out of sale of personal information,

00:08

the format for less than 3.5 will be very similar to how we reviewed the concept of a deletion request. Under less than 3.4, we will kick this off first by reviewing what opt out of sale request is,

00:20

we will then move on to defining what a sale of information truly is.

00:25

I will tell you ahead of time.

00:26

All third party data transfers are not necessarily sales of personal information and we will help to market that line.

00:35

Then number three, we will review to help really explain this concept further, Some examples of inter vs intra corporate data transfers. I always learn best by reviewing examples. And so, for those of you who always learn that way, we're gonna go through some common riel world scenarios

00:54

the same way we started last lesson. We're going to start out with a baseline rule once more.

00:59

Under the CCP A. A consumer has the right at any time to direct a business that sells personal information about that consumer to a third party not to sell the consumer's personal information

01:11

similar to delusion requests. This right here was one of the main reasons why the CCP a past

01:17

privacy advocates were very worried that businesses were able to sell personal information about consumers through third parties, and consumers had no capacity to object or opt out to that behavior at all.

01:30

The C C p A. Now provides consumers with the rights to stop and opt out of that transaction

01:36

Now. Important to note here,

01:38

you might have probably already seen when going through Web sites and surfing the Internet that there are do not sell links already popping up on the Internet.

01:47

That's actually a requirement of the C c. P. A.

01:49

We will discuss the do not sell link more in depth in module eight. Let's just put a mental note on that.

01:57

So

01:59

what is a sale?

02:00

A sale is defined again by the CCP A. As making available or transferring a consumer's personal information by one business to another business or third party for some sort of monetary or other valuable consideration.

02:14

Now,

02:15

I remember the first time I read that sentence. I was beyond lost, and I have a lot agreed. So I imagine you are probably equally lost.

02:23

So let's take a moment to unpackaged this a little further.

02:27

Let's keep in mind

02:29

if it's going to be monetary, then it'll be obvious. A third party or a separate businesses giving your employer money in order for you to transfer that information out of the network.

02:38

Now,

02:38

valuable consideration is so much more difficult to review.

02:43

We're actually going to give you some concepts. Basically, if the business that is receiving the information is in any way helping to expand your company's bottom line by transferring that information out,

02:53

it's likely that the C C P. A. Is going to apply to that scenario. And consumers have the ability to opt out of the transfer.

03:02

The California attorney general, funnily enough this summer, was given the opportunity to clarify what this sentence means

03:09

and actually refused to.

03:13

I think the sentence, they said, was we will follow the plain language meaning of what valuable consideration means,

03:19

very difficult to decipher.

03:21

So let me give some further context to what this means by identifying what isn't a sale, and then that should hopefully help us identify what is, if there ever is a situation in which a consumer direct your business to disclose or interact in any way with a third party,

03:36

that's not a sale.

03:38

There are situations where a consumer might approach your business and say, I'd like to buy this item. Please also use this certain shipping company etcetera to ensure that the package comes to my home.

03:51

If you are being instructed in any way to interact with the third party, that's not a sale, even if that's, in theory, expanding your revenues by engaging with that third party.

04:00

There also could be scenarios where the business might need to disclose personal information to a third party. In orderto stop this selling itself again

04:09

that won't apply.

04:11

Let's look at the bottom left of your screen for a moment.

04:14

Service providers. In the previous lessons, I've actually been specifically calling out companies like Salesforce or Office 3 65 or your cloud networks. All those vendors and service providers don't fall into this category because they're providing some sort of service to your company in order for your company to be able to operate

04:33

now,

04:34

very important here,

04:35

the vendor cannot later in time sell the information on their end,

04:41

they have to honor that the information will stay essentially trapped with the third party vendor.

04:46

In most cases, vendors understand that if you are looking at your outbound data flows, you can in most instances ignore your vendors because that's not what this section of the law is defined to regulate.

04:58

Then the top left. If there's ever a merger or acquisition that your business is going to experience, data is obviously going to be transferred from one parent company to another parent company.

05:09

But that doesn't count as a sale of data under the sea CPA.

05:14

I was having trouble. I have to tell you, trying to explain what a third party is under the C C p A.

05:19

When I was thinking about this and making these slides, I happen to be walking through the mall.

05:25

I passed these stores and I thought to myself, Oh, this is a great way to explain this concept.

05:30

You may or may not be aware that Gap Incorporated actually owns the four stores that I have on screen now. Old Navy, Banana Republic and Athleta all fall under Gap Incorporated.

05:42

If you were to buy a pair of jeans that say Old Navy,

05:46

You are likely and especially if you were to sign up for one of their loyalty programs and you were later in time were to enter a Banana Republic store.

05:54

They're going to already have your personal information.

05:58

Why? Because these four companies all fall under the same corporate umbrella.

06:02

They all provide more or less the same goods or service.

06:06

They interact with each other consistently.

06:11

In situations like these, that's not going to be considered a sale.

06:15

The general rule is the more connected a group of companies are, the less likely it is going to be considered a sail under the C C P. A.

06:24

Again, I recommend you get further outside. Help to try toe really understand if an exception applies here.

06:30

I understand that in the modern business environment, a lot of businesses owned other businesses.

06:34

And when there are those types of weird relationships,

06:39

those air typically not considered sales of personal information.

06:43

Now, an exception would maybe be, for example, if an airline is selling information toe Ah, hotel company.

06:49

That is clearly not the same as the scenario you see on screen here because it's providing a different type of good or service.

06:58

They are also independently owned by different shareholders.

07:01

Keep an eye on that. If you're looking at your opt out data flows, ask yourself, Does my company have any stake in that other company? Or do we usually interact with that other third party? Because we need to in order to complete the transaction?

07:15

It's a very hot topic and one that is going to get a lot of attention from regulators in the future.

07:21

In summary, we define for you. Hopefully what a sale is

07:26

again. It's a transfer of data from one business to another business for some sort of monetary or valuable consideration.

07:32

You're going to need my friends to use your best judgment, hopefully by providing for you examples of what is not considered a sale. That helps provide further clarity for scenarios that might be defined as a sale.

07:45

Then we've also reviewed typical third party transfers

07:47

Again, I tried to use the example of Old Navy and Banana Republic all falling under the corporate umbrella of Gap Incorporated

07:56

that would not be considered a third party data transfer, but scenarios where, like I said. If it's an airline transferring information to a cruise line or a hotel company or a rental car company, something like that

08:07

that is likely to be considered a sail under the C C p A.

08:11

That finishes up module three. We have a quick quiz and I will see you in Module four.