The CCPA does not apply because neither the customer nor Reach qualifies as a “business.”
A “business” is “a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders” (and meets several other criteria). Reach’s customers are not organized or operated for the profit or financial benefit of their shareholders and therefore do not qualify as a “business.”
A “business” is also the entity that determines the purposes and means of processing consumers’ personal information. For several reasons, the customer, and not Reach, assumes this role: (1) the customer owns all Campaign Data, defined as any data or information uploaded to or input in the software; (2) Reach may only process Campaign Data if “strictly necessary” to perform the services under the agreement; and (3) any use for Reach’s own internal purposes is limited to aggregate data only (which does not qualify as “personal information”). As a result, in this role, Reach does not qualify as a “business.”
Other Data Provided by Customers
Pursuant to the License Agreement, if this data is uploaded to the software by the customer, it is Campaign Data subject to the analysis above. Additionally, to the extent the data is “publicly available” – i.e., “lawfully made available from federal, state, or local government records” – it does not qualify as “personal information” subject to the CCPA.
Direct Collection of Data
This conduct falls within the CCPA if Reach qualifies as a “business.” Because of Reach’s size and the limited and non-commercial uses of personal information by Reach, it does not qualify as a “business” here.