The California Consumer Privacy Act (CCPA), which went into effect January 1, 2020, may apply to oil and gas operators who collect personal information from California (CA) residents for the purpose of distributing payments on the production of oil and gas.
Does the CCPA Apply?
As a practical matter, for most oil and gas operators, application of the CCPA will turn on whether (1) you collect the personal information of CA residents and (2) you have gross revenues in excess of $25M. An operator may satisfy the requirement of “doing business” in California by merely having contacts in the state, and it does not matter that the operator is not CA-based or lacks a physical presence there.
The full test is below. With some exceptions, if the answer to each of the five questions below is “yes,” then the CCPA is likely to apply to your business:
- Are you a for-profit entity?
- Do you do business in California?
- Do you collect the personal information (as defined by the CCPA) of CA residents?
- Do you determine the purposes and means of the processing of consumers’ personal information?
- Do any of the following apply?
- Annual gross revenues in excess of $25M
- Annually buys, receives for the business' commercial purposes, sells or shares for commercial purposes the personal information of 50,000 or more consumers, households or devices
- Derives 50% or more of its annual revenues from selling consumers' personal information
The law defines “personal information” very broadly. Included in that definition is:
Name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
For example, an oil and gas operator paying royalties to a CA resident will typically have personal information as defined by the law for those individuals. If the operator also has gross revenues in excess of $25M, the law likely applies.
Obligations under the CCPA
The CCPA creates a number of obligations for businesses subject to its provisions, including:
- Providing notice and disclosure to CA residents regarding the kinds of personal information the business collects and how that information is used, and what rights CA residents have under the CCPA
- Providing to CA residents a copy of their personal information in a useable format upon request
- Deleting the personal information of CA residents upon request
- Giving CA residents the right to opt-out of the sale of personal information
- Giving CA residents at least two ways to request information from a business, possibly more depending on the circumstances
- Training employees on how to comply with the CCPA
- Executing written agreements with service providers and other third parties to specify and limit the use of personal information
California attorney general (AG) enforcement actions will begin July 1, 2020.
On February 11, we will be offering a complimentary 60-minute webinar on the CCPA and we will focus on the following topics:
- Does the CCPA apply to me and my business?
- What rights do consumers have now that CCPA is in effect?
- What does CCPA require of companies nationwide, regardless of location of their headquarters?
- What could regulatory enforcement actions brought by the California AG look like?