What is the relationship between free speech and data privacy?

Question

I am learning the basics about CCPA, hoping to create a directory of organizations (and the people of those organizations), in a community-driven fashion like Wikipedia. From what I understand now, those in California have the right to request removal of their data from the system. Say our system allows the community to add information about individuals and businesses, which might include one particular customer. What are the laws relating to their right to request removal of such data, given that it is a free public resource of publicly available data (their name, social media accounts, etc.), and the "Exceptions to California Consumer’s Right to Delete" of which one is "Free Speech", and there are a few others. I don't know much about privacy laws, but what are the laws in relation to this sort of situation? Could it be said that it is free speech to share someones name, what about their phone number or address? I would like to learn more about privacy laws in this regard.

Answer 1

-CCPA section 1798.105 provides in paragraph (d) (4) that:

(d) A business or a service provider shall not be required to comply with a consumer’s request to delete the consumer’s personal information if it is necessary for the business or service provider to maintain the consumer’s personal information in order to:

...

(4) Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.

The California Attorney General (AG), whose office is charged with enforcing the CCPA, has published regulations clarifying the Act, but so, far none of them have dealt with this provision. I can find no case in which an action b y the AG's office, or a court case, has interpreted this provision.

There are many online guides to the CCPA, or FAQs or advice on how to comply, but most either do not mention 105 (4)(d) at all, or merely quote it, offering no further guidance.

The page CCPA Deletion Exempotions" by SixFifty, reads:

In Europe, the ‘right to be forgotten’ requires search engines like Google to remove certain results from search requests. A European who was arrested for a crime and then released, for example, might request that Google not direct people searching his name to old news reports of his arrest. Taking a different approach to tensions between privacy and speech, the CCPA protects data against deletion in order to allow the exercise of free speech, ensure the rights of other consumers to exercise free speech, or allow the “exercise of another right provided for by law.”

While many privacy advocates have encouraged states or the federal government to adopt the ‘right to be forgotten’ or broader deletion rights, there are concerns that such deletion could infringe on other fundamental rights. Clearly, California’s legislature is signaling that deletion of personal information is secondary to free speech when it weighs those rights against one another. Freedom of the press is likely to qualify as another “right provided for by law” that would negate a deletion request from a consumer under the CCPA.

This suggests that such an online directory, compiled as a public benefit, might be exempt as an exercise of free speech. But it is far from authoritative.

One should remember that the CCPA does not create a private right of action for the Request to Delete (or Request to Know) procedure. Only the California AG is empowered to enforce these rights. Consumers may file complaints with the office of the AG, but it is up to that office to decide whether to take action or not. Moreover, if the AG elects to take such action, it must give the business at least 30 days to cure any failure to act on the right to delete. If the business complies within 30 days after getting a notice from the AG's office, there is no penalty.

A person or organization operating such a directory service could rely on section 105(d)(4) as a basis to refuse requests, until and unless notified by teh AG that this is not valid. Or such a person could request the AG to clarify this section of the act, possibly by issuing a further regulation or issuing an opinion letter. The AG might or might not respond.

A person or organization operating such a directory service could ask a California lawyer to issue an opinion letter as to whether the operator is required to delete such info under such circumstances, having regard to 105(d)(4). Such a letter would establish a reasonable basis for action, and the good faith of the operator, even if the AG later took a different view. A lawyer would no doubt charge a fee for doing the research and writing such a letter.