United States: New California Direct Marketing Disclosure Statute Will Impact Companies Inside and Outside of California

Companies that disclose consumers’ personal information to third parties for use in direct marketing should prepare for the new obligations imposed by California’s direct marketing disclosure statute, which takes effect January 1, 2005.¹ This statute requires a covered company to provide individual California customers, upon request, with certain information about such disclosures. It also requires companies to notify these customers of their ability to request this information, and to provide a means of submitting requests. Consistent with other broad-reaching California privacy legislation, this statute is not limited to companies located in California, but purports to cover any company that has established a business relationship with California residents. Companies that disclose or have disclosed customers’ personal information to third-party direct marketers during 2004 should evaluate their obligations under this statute, and will need to act quickly to develop the necessary notification and request-processing procedures by January 1st.

Key Facts You Should Know About California Civil Code Section 1798.83

A company may be subject to California Civil Code Section 1798.83 if it has disclosed one of various categories of "personal information" to "third parties" during the prior calendar year, and if it knows or reasonably should know that these third parties used the personal information for their own direct marketing purposes.² For purposes of this statute, "personal information" is any information that identifies, describes or can be associated with an individual, and includes categories ranging from name, address, or e-mail address to products purchased, medicines used, and payment history.³

Any recipient of the personal information that is a separate legal entity from the disclosing company is considered a "third party" under this statute.⁴ Thus, the statute purports to cover disclosures to affiliates if they are separate legal entities. Where affiliates share the same brand name, however, the requirements of the statute are somewhat reduced. Additionally, the statute excludes specific types of business-related disclosures to third parties, such as disclosures to vendors used for data administration, marketing, and customer service, as long as those third parties do not disclose or use the information for their own direct marketing purposes.

The statute requires a company to respond to requests by a "customer," defined as a resident of California who provides personal information to the company pursuant to an established business relationship for personal, family or household purposes.⁵ While the statute only applies to requests for information by California residents, it is not by its terms limited to business relationships that occur only or entirely in California. Thus, it would apply to any mail order, internet or telephonic business relationship with a California resident, and potentially to business relationships that take place entirely outside of California. A company is required to respond to a customer’s request for information under this statute only one time per calendar year.

If a company is subject to this statute, it must be prepared to provide two types of information upon request: (a) a list of the categories of "personal information" disclosed to third parties for the third parties’ direct marketing purposes during the prior calendar year,⁶ and (b) the names and addresses of those third parties. If the nature of a third party’s business cannot be determined from its name, the company also should provide examples of the third party’s products or services.

Significantly, the statute does not require companies to provide an individualized response identifying the types of personal information disclosed regarding the particular customer making the request. Instead, companies can provide standardized information covering all disclosures of customers’ personal information during the prior year.⁷

The response to the customer request for information on third party disclosure must be provided within 30 days if the request is sent to the designated address or numbers, or within a maximum of 150 days if the request is made in some other fashion.

Any company covered by this statute must designate a mailing or email address or provide a toll-free telephone or facsimile number for customers to use in submitting requests for information under this statute. In addition, the company must implement at least one of the three notification options provided under the statute.⁸ The first option involves notifying the supervisors of employees who have regular customer contact about the designated address or toll-free number, and instructing them that this information should be provided in response to customer inquiries about the company’s privacy practices. The second option involves modifying the company’s online privacy policy to describe the customer’s rights under this statute and provide the designated address or toll-free number. The third approach involves making the designated address or toll-free number available upon request at every place of business in California where the company regularly has contact with customers.

The statute encourages companies to choose the option of providing this information in their online privacy policies, by allowing companies that follow this approach to disregard requests that are not submitted to the company’s designated address or toll-free number.⁹ Otherwise, a company must respond to a request that is received at a different address or number, although the normal thirty-day period for the response may be extended up to a maximum of 150 days in those circumstances.

• Obtain legal advice regarding your company’s obligations under this statute.

• Begin developing procedures to comply with Civil Code Section 1798.83 without delay, as the law goes into effect on January 1, 2005.

• Designate an address or toll-free number for California customers to use in requesting information under this statute.

• Prepare a disclosure sheet containing the information required by the statute, covering calendar year 2004.

• Select at least one of the three options for notifying California customers of their ability to request information under this statute. We generally recommend covering this statute in the online privacy policy, as this would allow the company to respond to only those requests that are received at the designated address or toll-free number.

• Create procedures for receiving, processing, and responding to requests for information within the 30 day period.

While California’s direct marketing disclosure statute does not regulate or restrict the disclosure of personal information, it imposes significant new obligations on companies that do share personal information with affiliates or other third parties. Accordingly, all companies covered by the statute should take steps to review and to ensure compliance with Civil Code Section 1798.83 before it becomes effective on January 1, 2005.

Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Morrison & Foerster LLP. All rights reserved