This article shares highlights of the on-demand webinar, “CPRA & the 2023 Alphabet Soup of U.S. Privacy Regulations.” View the full webinar here. 

California’s enactment of the California Consumer Privacy Act (“CCPA”) in 2018 signaled a fundamental shift in the U.S. approach to privacy. As of 2023, California has added protections via the California Privacy Rights Act (“CPRA”), and several states have adopted their own state consumer privacy laws.

GDPR principles are coming to the U.S., and it’s important for businesses operating domestically and internationally to learn about the constantly evolving requirements and get familiar with the steps that we need to take for compliance.

We recently hosted a webinar to explore the latest developments in U.S. privacy laws with featured speaker Jenny Sheridan, Principal, JL Sheridan Law. Set in the context of a hypothetical B2B SaaS company analyzing its to-dos for CPRA and other state privacy law compliance, we explored:

• An Overview of the U.S. privacy law landscape coming into 2023
• New rights under CPRA (e.g., employee data, sensitive personal information, automated decision-making, etc.)
• High-level overviews of the other U.S. state privacy laws.

Here are some key highlights from the discussion:

Privacy Compliance in California and Four Additional States

In 2018, California passed the first consumer privacy law of its kind in the U.S. – the California Consumer Privacy Act (“CCPA”). The CCPA took effect in 2020. It has since been amended – pretty significantly – by the California Privacy Rights Act (“CPRA”). The CPRA modifications to the CCPA took effect in January 2023. And four more U.S. states have followed California’s lead passing privacy laws as well: Virginia, Colorado, Connecticut, and Utah.

GDPR Is Coming

One overarching theme is that GDPR principles are coming to the U.S., as seen in the recently passed new state consumer privacy laws. While California opted to create some new terminology, the VA, CO, CT, and UT state laws have incorporated existing GDPR terminology (e.g., data controller, data processor). While California originally took a less restrictive approach, the CPRA amendments and new state laws have begun to incorporate some GDPR principles (e.g., purpose limitation, data minimization, opt-in consent). It’s a new world that we’re seeing in 2023 with this GDPR influence. And whether States’ interpretation and enforcement will follow EU precedent remains to be seen.

What Are The New Consumer Rights Under the CPRA Amendments?

• The original CCPA moratorium, which provided exemptions for B2B and employee data, expired on January 1, 2023.
  • B2B Customer’s personal information is now covered and treated like any consumer data, requiring the same notices and same rights.
  • Employee information is now covered and treated like any consumer data, requiring the same notices and same rights.
• The consumer has the right to request that a business correct any inaccurate personal information.
• The consumer has the right to limit the use and disclosure of their sensitive personal information (“SPI”).
  • SPI categories unique to California: government IDs, consumer log-in, financial accounts, debit/credit # and required security/access code, consumer’s email content unless business intended recipient.
  • Other categories of SPI common to California and the other US state laws includes precise geolocation; racial/ethnic origin, religious, philosophical, union membership; genetic, biometric, and health data/sex life/sex orientation data. Personal data of a known child is included in these other US state laws and not California as SPI.
  • CA has an opt-out right for SPI.
    • In CA, the covered business that is collecting SPI, has to offer the consumer the right to limit the use of the sensitive PI subject to certain exceptions; one important exception is to “perform the services or provide the goods reasonably expected by an average customer.” For example, a company offering genetic testing services could collect the sensitive information necessary to provide the services without offering the right to limit the use of that sensitive information.
    • The other states have followed GDPR’s opt-in approach, where they need to obtain the consumer’s prior consent to process the SPI.
    • This “split” creates questions about harmonization across that states where the most likely approach for processing SPI will be to implement an opt-in approach.
• Risk Assessments for High-Risk Data Processing.
  • In CA, if you are a business engaging in high-risk data processing, you have to perform a risk assessment. Comparable to the GDPR DPIA requirements. The new California Privacy Protection Agency (“CPPA”) will create rules that will help lawyers understand mechanically the requirements of the risk assessments.
  • VA, CO, CT have risk assessment requirements and get more specific about what is considered high-risk data processing, including such activities as targeted advertising or processing sensitive data.
• The consumer has the right to request information about and the right to opt out of automated decision-making (“ADM”).
  • CPPA will adopt regulations “governing access and opt-out rights” with respect to businesses’ use of ADM technology.
  • VA, CO, and CT have similar provisions.

Jenny’s Updated Checklist in 2023

Jenny shared the checklist that she uses to address these updates with her clients:

1. Engage with HR and go through Employee Data for California to provide required notices / update employee manuals.
2. Revisit the client’s business and confirm understanding of data and use.
3. Revise the privacy policy to look more like B2C policies for B2B companies in CA.
4. For B2C companies, consider adding the applicable rights for VA, Colorada, CT and Utah consumers.
5. Evaluate whether the client needs the “do not sell” and “do not share” buttons.
6. Evaluate whether the client is processing any SPI? If you are going to assert an exemption, you should document your assessment and analysis.
7. Evaluate whether there is High-Risk Data Processing. Do you need to do a risk assessment?
8. Evaluate whether the client is using ADM and be prepared to respond to requests about the ADM.

Tips for Staying Up To Date

• Get involved with IAPP.
• If you are in California, join the Privacy Committee of the California Lawyers Association.
• Subscribe to the California Privacy Protection Agency Mailing List to receive notices for board meetings and materials and review the recent Regulations and Rulemaking Activity.

Need additional support in this area of your business? Contact us today for project support with our flexible legal talent solutions. And be sure to follow Paragon Legal on LinkedIn, and feel free to reach out to us with questions.

This article shares highlights of the on-demand webinar, “CPRA & the 2023 Alphabet Soup of U.S. Privacy Regulations.” View the full webinar here.

“Juneteenth has never been a celebration of victory or an acceptance of the way things are. It’s a celebration of progress. It’s an affirmation that despite the most painful parts of our history, change is possible—and there is still so much work to do.” – Barack Obama

How are you going to celebrate Juneteenth this year? Will June 19th be just another day off from work, or will you take time to attend a celebration in your hometown, to visit a Black museum, or eat out at a Black-owned restaurant? Maybe you will prefer to stay in and bake red velvet cupcakes while watching a good movie. Here are some recommendations for ways to celebrate our progress in the fight for equality and the rich history and culture of Black Americans.

• Make going to a museum your new Juneteenth tradition.
  18 Black Museums to Visit Across the U.S.
• The San Francisco Museum of the African Diaspora offers a free in-person event.
  Juneteenth Freedom Day @MoAD
• Read an article or listen to a podcast to learn more about Juneteenth.
  Juneteenth: The History of a Holiday
• A great way to commemorate Juneteenth is to support Black-owned businesses.
  Black-Owned Book Stores You Can Shop Online
  20 Historic Black-Owned Restaurants You Need to Eat At
  31 Black-Owned Beauty Brands That Belong on Your Top Shelf
• Check out these movie recommendations to remember the struggle and celebrate Black culture.
  Looking for Black Movies to Watch for Juneteenth?
• Red is one of the colors associated with Juneteenth. Raise your glass to celebrate with red hibiscus sweet tea.
  Juneteenth Red Foods and Drinks

Foster J. Sayers III, General Counsel & Chief Evangelist, Pramata Corporation

ChatGPT has taken the world by storm and the legal industry is no exception. While some are feeling breathless at its arrival others have already embraced the technology into the products they provide. What few have raised are the very real ethical concerns that using ChatGPT presents to attorneys. A review of the Model Rules of Professional Conduct, the Terms of Use for ChatGPT and its FAQ, show that attorneys risk ethical violations if they choose to use ChatGPT in providing legal services to their clients.

Most states have adopted a version of the Model Rules of Professional Conduct (MRPC) and require that an attorney maintain the confidentiality of client information. In MRPC 1.6: Confidentiality of Information, the first subsection (a) states, “A lawyer shall not reveal information relating to the representation of a client unless the client gives informed consent, the disclosure is impliedly authorized in order to carry out the representation or the disclosure is permitted by paragraph (b).” Paragraph (b) lists seven exceptions to breaking confidentiality, such as “to prevent reasonably certain death or substantial bodily harm”, but none of them are using technology to do some or all work related to a client representation. As such, any attorney wishing to use ChatGPT to perform services related to the representation of the client must first obtain the client’s consent. Paragraph (c) goes on to state, “A lawyer shall make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the representation of a client.” This raises a concern given how information in ChatGPT is viewable by more than the user and the AI.

Ethical concerns arise because the conversation with ChatGPT is not merely an exchange with a computer program where there should be an expectation of privacy – human beings review user conversations with ChatGPT. Number 5 on the ChatGPT FAQ is “Who can view my conversations?” The answer is “As part of our commitment to safe and responsible AI, we review conversations to improve our systems and to ensure the content complies with our policies and safety requirements.” Number 6 is “Will you use my conversations for training?” The answer is “Yes. Your conversations may be reviewed by our AI trainers to improve our systems.” If you were to discuss information you did not intend to when providing ChatGPT a prompt, you’re not able to delete it, as noted in the answer to question number 8, “No, we are not able to delete specific prompts from your history. Please don’t share any sensitive information in your conversations.” [emphasis added]. The FAQ makes it clear that there should be no reason to believe your conversation will be kept safe from human eyes.

Ethics rules experts might recall comment 19 to MRPC 1.6 which contemplates entering into a confidentiality agreement to ensure any client information that is transmitted or disclosed will be kept in confidence. From comment 19, “Factors to be considered in determining the reasonableness of the lawyer’s expectation of confidentiality include the sensitivity of the information and the extent to which the privacy of the communication is protected by law or by a confidentiality agreement.” However, in the ChatGPT Terms of Use, there is no protection for confidential information. In section 5, “Confidentiality, Security and Data Protection” it states, “Confidential Information means nonpublic information that OpenAI or its affiliates or third parties designate as confidential or should reasonably be considered confidential under the circumstances, including software, specifications, and other nonpublic business information.” Information provided in your conversations to ChatGPT is excluded from that definition and afforded no protection. This is surely the reason that ChatGPT expressly cautions against sharing sensitive information in your conversations as noted in the FAQ excerpt above.

Attorneys have a professional responsibility to be competent in their practice as established in MRPC 1.1 Competence. Comment 8 to rule 1.1 states that “To maintain the requisite knowledge and skill, a lawyer should keep abreast of changes in the law and its practice, including the benefits and risks associated with relevant technology, engage in continuing study and education and comply with all continuing legal education requirements to which the lawyer is subject.” ChatGPT is a perfect example where the apparent benefits need to be weighed against the risks associated with using it. Work can be greatly accelerated, but what if the lack of confidentiality exposes your client to an unforeseen risk? You reviewed a competitive bid for your client more quickly using ChatGPT, but it ended up being seen by a QA analyst at OpenAI who has no obligation of confidentiality and whose spouse works for your competitor. It’s the job of an attorney to think through these potential risks and consider whether they can competently employ ChatGPT without compromising their ethical obligations to the client.

A breach of client confidentiality is not only an ethical concern, but it also risks a waiver of attorney-client privilege. For attorney-client privilege to be established, the communication must be between the attorney and the client and concern seeking or providing legal advice. To maintain the privilege, the communication must be kept confidential. If the communication is then used in a prompt to ChatGPT then it has not been kept in confidence and this would constitute a waiver of attorney-client privilege. As such, preserving attorney-client privilege is another reason that lawyers need to be extremely cautious about leveraging AI to provide legal services.

There are ways that AI can be used ethically to reduce the time that lawyers spend on work, but most of those are related to automation of administrative tasks. That’s still a great thing. Lawyers need more time to exercise their expertise and so, for example, using AI to automate the storage of executed contracts is a great way to do that. However, encumbering AI with the exercise of their expertise is invariably going to give rise to ethical concerns that will need to be addressed before being adopted. 

About the Author

As Pramata’s general counsel and chief evangelist, Foster Sayers is passionate about using his technical knowledge to help legal professionals be more effective. Previously, Sayers was corporate counsel for Vertafore, where he led the company’s transformation of the contract lifecycle and automated the processes for organizing, storing and digitizing the company’s executed agreements using Pramata. He also co-founded 121Nexus, a business with QR code technology solutions for the pharmaceutical and biomedical industries. Earlier in his career, Sayers held in-house counsel positions for companies in industries such as manufacturing, video and IT. Sayers has a law degree from Florida State University College of Law and a bachelor of arts degree in international politics and Japanese from Penn State University.

Pramata makes contract management radically simple. With Pramata’s end-to-end solution, legal teams can easily and accurately manage the entire contract lifecycle – from request to renewal. Pramata does the heavy lifting to give companies the precise contract insights they need and help legal teams provide unparalleled value to the business.