Enforcement: California Privacy Protection Agency’s First Settlement

On March 12, the California Privacy Protection Agency (“CPPA”) announced its first enforcement settlement action under the California Consumer Privacy Act (“CCPA”) against American Honda Motor Co., Inc. (“Honda”). Pursuant to the settlement, Honda has agreed to change its privacy related business practices and pay a $632,500 fine to resolve the claims it violated the CCPA.

Generally, both the CPPA and the California Attorney General have the authority to enforce the CCPA. Pursuant to the CCPA, the CPPA enforces the CCPA through administrative proceedings, cease-and-desist orders, and administrative fines, while the California Attorney General has the power to investigate violations and seek ensuing injunctions and civil penalties. Either enforcing agency may seek civil penalties up to either:

• • $2,500 per violation; or
  • Up to $7,500 per intentional violation and each violation involving the personal information of minor consumers

The CPPA Board issued its decision claiming that Honda violated the rights of California consumers by:

• • Unlawfully requiring Californians to verify themselves and provide excessive personal information to exercise their CCPA rights, including the right to opt-out of sale or sharing and the right to limit;
  • Making it difficult for Californians to authorize other individuals or organizations (known as “authorized agents”) to exercise their privacy rights;
  • Using an online cookie management tool that failed to offer Californians their privacy choices in a symmetrical or equal way; and
  • Sharing consumers’ personal information with advertising companies without producing contracts that contain the necessary terms to protect privacy.

As a result of such violations, Honda was ordered to pay an administrative fine of $632,500, which included $382,500 attributable to conduct toward, “119 [California consumers] who were required to provide more information than necessary to submit their Requests to Opt-out of Sale/Sharing and Requests to Limit, 20 [California consumers] who had their Requests to Opt-out of Sale/Sharing and Requests to Limit denied because Honda required the [California consumer] to Verify themselves before processing the request, and 14 [California consumers] who were required to confirm with Honda directly that they had given their Authorized Agents permission to submit their Request to Opt-out of Sale/Sharing and Request to Limit on their behalf.” In addition, Honda will be required to brings its business practices into compliance with the CCPA, including implementing a new and simpler process for California consumers to assert their rights under the CCPA.

We will continue to monitor for any significant data privacy enforcement developments.