CCPA Service Provider Requirements Clarified By California AG

Readers of this blog know that we have been analyzing both the draft California Consumer Privacy Act ("CCPA") regulations and the California Attorney General's associated effort to clarify and modify the CCPA before it takes effect on January 1, 2020. Today, we would like to address Section 999.314 of the proposed regulations, a provision intended to: 1) clarify the breadth of the CCPA service provider exception; and 2) address how service providers should handle CCPA-related consumer requests.

Who is a CCPA service provider and how should service providers handle consumer requests?

Defining CCPA Service Provider

The CCPA defines a "service provider" as any entity operated for profit that "processes information on behalf of a business and to which the business discloses a consumer's personal information for a business purpose pursuant to a written contract . . . ." Transferring a consumer's personal information to a service provider (in its capacity as a