Ahead of its December 8 board meeting, the California Privacy Protection Agency (CPPA) has issued draft “automated decisionmaking technology” (ADMT) regulations.  The CPPA has yet to initiate the formal rulemaking process and has stated that it expects to begin formal rulemaking next year.  Accordingly, the draft ADMT regulations are subject to change.  Below are the key takeaways:

ADMT Definition: The draft regulations propose a broad definition of ADMT.  Specifically, ADMT means “any system, software, or process—including one derived from machine-learning, statistics, or other data-processing or artificial intelligence—that processes personal information and uses computation as whole or part of a system to make or execute a decision or facilitate human decisionmaking.”  The draft regulations also include “profiling” within the ADMT definition. 

“Pre-use Notice”: The draft regulations propose adding a new section to the CPPA regulations that would require businesses using ADMT for certain activities (i.e., activities that would require a business to grant consumers opt out and access rights as described below) to provide consumers with a “Pre-use Notice.”  The Pre-use Notice must inform consumers about the business’s use of ADMT and consumers’ rights to opt out of, and to access information about, the business’s use of ADMT.  The Pre-use Notice must include:

  • A plain language explanation  of the purpose for which the business proposes to use the ADMT that avoids the use of generic terms (e.g., “to improve our services”);
  • A description of the consumer’s right to opt-out of the business’s use of the ADMT for certain processing activities (described below);
  • A description of the consumer’s right to access information about the business’s use of the ADMT for the same processing activities that require opt out rights and how the consumer can submit their access request; and
  • A “simple and easy-to-use method” (e.g., a layered notice or hyperlink) by which the consumer can obtain additional information about the business’s use of the ADMT.

A business is not required to provide a Pre-use Notice if it is using the ADMT for certain exceptions (e.g., security, fraud prevention, safety, or to provide a requested good or service).

Requests to Opt Out of ADMT: The draft regulations would require a business to provide a consumer with a Pre-use Notice, as described above, and opt out rights for the following uses:  (a) decisions that produce a legal or similarly significant effects concerning a consumer, (b) profiling a consumer who is acting in their capacity as an employee, independent contractor, job applicant, or student, (c) profiling a consumer while they are in a publicly accessible place, (d) profiling a consumer for behavioral advertising, (e) profiling a consumer that the business has actual knowledge is under the age of 16, or (f) processing the personal information of consumer to train ADMT.  The uses in (d)-(f) are marked as “additional options for board discussion.”  Upon receiving an opt out request, a business must comply with the request by “ceasing to process the consumer’s personal information using that [ADMT].”  The draft regulations explain that the opt out applies to information used or retained for the ADMT.  The draft regulations specify that a business does not need to provide consumers with an opt out of ADMT if the business’s use of the ADMT complies with certain exceptions. 

Requests to Access Information About ADMT: As mentioned above, for certain ADMT use cases, the draft regulations would require a business to provide consumers with certain information regarding the business’s use of ADMT.  Unless an exception applies, the draft rules would require a business to provide the following information in response to a consumer’s access request: 

  • The purpose for using the ADMT;
  • Output(s) of the ADMT with respect to the consumer;
  • How the business used the output to make a decision with respect to the consumer;
  • If the business plans to use the output to make a decision with respect to the consumer, the business’s explanation must include specification regarding the ADMT’s functions, including its logic, the key parameters that affected the output, and how these parameters were applied to the consumer.
  • How the ADMT worked with respect to the consumer (i.e., how the logic, including its assumptions and limitations, was applied to the consumer and the key parameters that affected the output of the automated decisionmaking technology);
  • A simple and easy-to-use method by which the consumer can obtain the range of possible outputs;
  • Instructions for how the consumer can exercise their other CCPA rights; and
  • The method by which the consumer can submit a complaint to the business about the business’s use of the ADMT.
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection…

Jayne Ponder is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity Practice Group. Jayne’s practice focuses on a broad range of privacy, data security, and technology issues. She provides ongoing privacy and data protection counsel to companies, including on topics related to privacy policies and data practices, the California Consumer Privacy Act, and cyber and data security incident response and preparedness.

Photo of Hensey A. Fenton III Hensey A. Fenton III

Hensey Fenton specializes in providing advice and guidance to clients on legislative and regulatory strategies. Hensey counsels clients on a myriad of issues in the policy and regulatory space, including issues involving cybersecurity, financial services, artificial intelligence, digital assets, international trade and development…

Hensey Fenton specializes in providing advice and guidance to clients on legislative and regulatory strategies. Hensey counsels clients on a myriad of issues in the policy and regulatory space, including issues involving cybersecurity, financial services, artificial intelligence, digital assets, international trade and development, and tax.

Another facet of Hensey’s practice involves cutting-edge legal issues in the cybersecurity space. Having published scholarly work in the areas of cybersecurity and cyberwarfare, Hensey keeps his finger on the pulse of this fast-developing legal field. His Duke Journal of Comparative & International Law article, “Proportionality and its Applicability in the Realm of Cyber Attacks,” was highlighted by the Rutgers Computer and Technology Law Journal as one of the most important and timely articles on cyber, technology and the law. Hensey counsels clients on preparing for and responding to cyber-based attacks. He regularly engages with government and military leaders to develop national and global strategies for complex cyber issues and policy challenges.

Hensey’s practice also includes advising international clients on various policy, legal and regulatory challenges, especially those challenges facing developing nations in the Middle East. Armed with a distinct expertise in Middle Eastern foreign policy and the Arabic language, Hensey brings a multi-faceted approach to his practice, recognizing the specific policy and regulatory concerns facing clients in the region.

Hensey is also at the forefront of important issues involving Diversity, Equity and Inclusion (DEI). He assists companies in developing inclusive and sustainable DEI strategies that align with and incorporate core company values and business goals.

Prior to joining Covington, Hensey served as a Judicial Law Clerk for the Honorable Judge Johnnie B. Rawlinson, United States Court of Appeals for the Ninth Circuit. He also served as a Diplomatic Fellow in the Kurdistan Regional Government’s Representation (i.e. Embassy) in Washington, DC.

Photo of Jorge Ortiz Jorge Ortiz

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related…

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related to privacy policies and compliance obligations under U.S. state privacy regulations like the California Consumer Privacy Act.