The hastily drafted CCPA raises serious issues concerning the attorney-client privilege, work-product doctrine, and client confidentiality.  Drafted in approximately one-week as a political compromise to address a proposed privacy ballot initiative,¹ the CCPA contains provisions that are all too unclear regarding an attorney’s obligations to maintain client confidentiality and privilege.  Without further clarification from the legislature or the California Attorney General’s rulemaking process, this lack of clarity is likely to lead to litigation.

The crux of the problem lies in the CCPA’s broad reach and its vaguely worded exemptions.  The CCPA confers an obligation upon businesses (a term which could apply to many law firms and their corporate clients depending upon the factual circumstances) to provide privacy notices to individuals about whom information is collected, to provide individuals with access to information held about them, and, in some instances, to delete information about individuals upon their request.  As it is currently written, the CCPA contains an exemption which states that the “obligations imposed on businesses by Sections 1798.110 to 1798.135 [of the CCPA], inclusive, shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law . . . .”²  While the legislature presumably intended to ensure that the CCPA did not require a business or its outside counsel to disclose privileged information, on its face the exemption is limited only to the obligations imposed by “Sections 1798.110 to 1798.135.”  It expressly does not apply to obligations imposed by other sections of the CCPA, such as Sections 1798.100 or 1798.105.

Sections 1798.100 and 1798.105 are particularly relevant when it comes to attorney-client privilege, work-product, and client confidentiality.  Section 1798.100 contains within it the requirement that a business must, in response to an access request, “provide” to a consumer “specific pieces of personal information the business has collected” about the individual.³  Section 1798.105 contains within it the requirement that a business must, in response to a valid deletion request, “delete the consumer’s personal information from its records. . . .”⁴  The net result is that the statute does not on its face prevent a California resident from requesting that an attorney, or a business, disclose privileged, work-product, or confidential information that relates to the California resident, nor does it prevent the California resident from requesting that a law firm (or its client) delete privileged information that relates to the individual.

Other more general exemptions to disclosure in the CCPA could arguably apply, although it is unclear whether the legislature intended that these exemptions cover privileged, work-product, and confidential information of a client.  For instance, Section 1798.145(j) states that none of the “rights afforded to consumers and the obligations imposed on the business” should “adversely affect the rights and freedoms of other consumers,” while Section 1798.145(a)(1) provides “the obligations imposed on businesses by this title shall not restrict a business’s ability to … [c]omply with federal, state, or local laws.”⁵  A business or law firm faced with the question of whether it must disclose privileged, work-product, or confidential information may turn to these sections to argue that the CCPA should not supersede other state laws concerning privilege, work-product, or an attorney’s ethical obligations to maintain client confidentiality.⁶  However, a consumer seeking disclosure of the information may conversely argue the more specific should govern over the general.  Because the specific exemption concerning evidentiary privileges (such as privilege) expressly does not apply to all sections of the CCPA, so the argument goes, these other more general exemptions should not apply either.

As a result of the lack of clarity in the statute, Bryan Cave Leighton Paisner, LLP has specifically requested that the California Attorney General issue rulemaking clarifying that privileged, work-product, and confidential information of a client is exempt from disclosure under all of the provisions of the CCPA.  Without rulemaking from the Attorney General or further clarification from the legislature, the CCPA otherwise leaves important issues that lie at the heart of the attorney-client relationship to the uncertainties of litigation.