California Privacy Notice

Effective Date: January 1, 2020; updated as of January 1, 2021

This notice reflects our good-faith understanding of the California Consumer Privacy Act (the “CCPA”) and our data practices as of the date posted (set forth above), but the CCPA’s implementing regulations recently became final, and there remain differing interpretations of the law. Accordingly, we may, from time-to-time, update information in this and other notices regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to Baker & Hosteler LLP’s (“BakerHostetler,” “us,” “we,” or “our”) other privacy policies or notices. In the event of a conflict between any other BakerHostetler policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the California law. Please see also any general privacy policy or notice posted or referenced on our websites, apps, products, or services including, without limitation, our online Privacy Policy.

This Notice covers our collection, use, disclosure, and sale of California Consumers’ “Personal Information” or “PI” as defined by the CCPA, except to the extent such PI is exempt from the notice obligations of the CCPA for the twelve months preceding the Effective Date. The description of our data practices in Section 1 of this Notice, as required by the CCPA, covers only calendar year 2020 and will be updated annually. Our practices in calendar year 2021 may differ. However, if materially different from this Notice we will provide pre-collection notice of the current practices, which may include reference to our general privacy policy or other applicable privacy notices, which will reflect current practices. Section II of this Notice explains the rights available to California Consumers.

As a law firm, much of the data we collect and process is not subject to CCPA Consumer rights. Without limiting the foregoing:

  • Consistent with the CCPA, job applicants, current and former employees, and independent contractors, other than prospective, current, and former partners of BakerHostetler (“Personnel”), and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business are not considered “Consumers” for purposes of this California Privacy Notice or the rights described herein.
  • PI subject to an evidentiary privilege, such as the attorney-client privilege and/or attorney work product protection, is not subject to the rights available to California Consumers as described in Section II; however, we do include this PI in the general disclosures in Section I.
  • Publicly available information (as defined by the CCPA) is not PI under the CCPA and not included in the disclosures under Section I and is not data to which Consumers have rights as described in Section II.
I. COLLECTION AND USE OF PERSONAL INFORMATION

We collect PI about California Consumers, which in the calendar year 2020 included the following:

Category Examples of PI Collected Sources of PI Purposes for PI Collection Categories of Recipients

Identifiers

(as defined in CCPA §1798.140(o)(1)(A))

Name, postal address, email address, identification numbers From the Consumer, Clients, Service Providers, Government Entities, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to contact you, to verify your identity, to provide services, and to comply with our legal obligations.

Business Purpose Disclosure:

Clients; Government Entities; Tribunals; and Investigative and Paraprofessional Services and Firms, Data Processors and Storage Providers, and other Service Providers

Sale: Not Sold.

Personal Records

(as defined in CCPA §1798.140(o)(1)(B))

Name, postal address, telephone number, email address From the Consumer, Clients, Government Entities, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security

For example, these purposes include business management and planning, to provide services, and to comply with our legal obligations.

Business Purpose Disclosure:

Clients; Data Subjects; Government Entities; Tribunals; and Investigative and Paraprofessional Services and Firms, Data Processors and Storage Providers, and other Service Providers

Sale: Not Sold.

Personal Characteristics or Traits

(as defined in CCPA §1798.140(o)(1)(C))

Marital / familial status, race, religion, disabilities From the Consumer, Clients, Government Entities, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to provide benefits to our partners, and services to our clients.

Business Purpose Disclosure:

Clients; Data Subjects; Government Entities; Tribunals; and Investigative and Paraprofessional Services and Firms, Data Processors and Storage Providers, and other Service Providers

Sale: Not Sold.

Commercial Information / Account Details

(as defined in CCPA §1798.140(o)(1)(D))

Purchase history or tendencies From the Consumer, Clients, Government Entities, Service Providers, and Third Parties.
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to provide benefits to our partners and services to our clients.

Business Purpose Disclosure:

Clients; Data Subjects; Government Entities; Tribunals; and Investigative and Paraprofessional Services and Firms, Data Processors and Storage Providers, and other Service Providers

Sale: Not Sold.

Internet Usage Information

(as defined in CCPA §1798.140(o)(1)(F))

Information regarding interactions with our website, computer systems, and/or devices From the Consumer, Service Providers and Third Parties.
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development;
  • Quality Assurance;
  • Security; and
  • Debugging
For example, these purposes include to improve our services, including providing users more relevant content, and to secure our network and protect our personnel.

Business Purpose Disclosure:

Marketing and Analytics Vendors and other Service Providers

Sale: Not Sold.

Professional or Employment Information

(as defined in CCPA §1798.140(o)(1)(I))

Job title, employer, practice area or industry focus From the Consumer, Clients, Government Entities, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development; and
  • Quality Assurance
For example, these purposes include to provide benefits to our partners and to market them to clients and prospective clients.

Business Purpose Disclosure:

Clients; Data Subjects; Government Entities; Tribunals; and Investigative and Paraprofessional Services and Firms, and other Service Providers

Sale: Not Sold.

Inferences from PI Collected

(as defined in CCPA §1798.140(o)(1)(K))

Customer profiles reflecting preferences From the Consumer, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development; and
  • Quality Assurance

For example, for business management and planning and to provide services.

Business Purpose Disclosure:

Marketing Vendors and other Service Providers.

Sale: Not Sold.

The chart above reflects the categories of PI required by the CCPA. There may be additional information that we collect that meets the CCPA’s definition of PI but is not reflected by a category, in which case we will treat it as PI as required by the CCPA, but will not include it when we are required to describe our practices by category of PI.

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat de-identified data or aggregate consumer information (each as defined by the CCPA) as PI, and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate consumer information.

We may share your PI with our Service Providers, including those that facilitate advertising and marketing, and other categories of recipients as described in the table above, for the same purposes as the collection purposes set forth in that chart. Subject to the CCPA’s restrictions and obligations, our Service Providers also may use your PI for certain permitted business purposes (e.g. security and fraud prevention). Our Service Providers may themselves engage service providers or subcontractors to enable them to perform services for us; such sub-processing is an additional business purpose for which we are providing you notice.

BakerHostetler does not believe it has sold (as the term “sale” is defined by the CCPA) Consumer PI in 2020. As the law evolves we may revisit this conclusion and, if applicable, revise this Notice. See Section II below regarding our current conclusion that data collection by third-party cookies associated with our web sites is not a sale by us under the CCPA.

II. CALIFORNIA PRIVACY RIGHTS

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process, which will depend on the nature of the request and the PI requested and will be further explained in response to a request. We will not fulfill your CCPA request unless you have provided sufficient information for us to be satisfied that you are the Consumer about whom we collect the applicable PI. Please promptly respond to any follow-up inquiries so that we may verify your identity. If you request that we provide you with specific pieces of information about you, or that we delete sensitive PI, we may apply heightened verification standards than what we would apply to other types of requests. For a categories request, or a request to delete non-sensitive PI, we require verification to a reasonable degree of certainty. Authorized agents who meet the agency requirements of the CCPA may submit requests on behalf of Consumers, which will also be subject to a verification process, here.

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about Consumers for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. We will use PI provided in your request only to verify your identity or authority to make the request and as necessary to track and document requests and responses, unless you also provided the PI to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, use, store, disclose, or otherwise process and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may provide you with a summary of your PI and give you the opportunity to elect whether you want us to provide the entire data set. Alternatively, we may direct you on how to access and copy responsive PI yourself. We may charge a reasonable fee or refuse to act upon a request if the request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may decline to comply with the request, we will give you notice explaining why we made that decision. In the case of a fee, we will provide a cost estimate and the opportunity to accept such fees before charging you for responding to your request.

We may collect, use, and disclose your PI as required or permitted by applicable law, and this may override your CCPA rights. Please also note we are not obligated to comply with Consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s rights, or conflict with applicable law.

Your California Consumer privacy rights are described below. To make a request, use our portal here, email us, or call us at (888) 914-9661, Extension PIN: 530 983, and provide us with your name, email address, phone number, the nature of your inquiry, and, if you are disabled, any accessibility accommodations you require.

Disclosure Rights (“Right to Know”)

i. Information Rights (“Categories”)

California Consumers have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the twelve-month period prior to the request date:

  1. The categories of PI we have collected about you.
  2. The categories of sources from which we collected your PI.
  3. The business or commercial purposes for our collecting or selling your PI.
  4. The categories of third parties with whom we have shared your PI.
  5. A list of the categories of PI disclosed for a business purpose, in the prior twelve months, along with the categories of recipient for each category of PI, or that no disclosure occurred.
  6. A list of the categories of PI sold about you in the prior twelve months, along with the categories of recipient for each category of PI, or that no sale occurred.

If we cannot verify your identity to a reasonable degree of certainty, we will not deliver the category information either but will refer you to the disclosures in Section I above.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant for the twelve-month period prior to your request.

ii. Obtaining Copies of PI (“Specific Pieces”)

California Consumers have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of their PI that we have collected (in the twelve-month period prior to the request date) and maintain. In order to protect the privacy and data security of Consumers, we will require a high degree of certainty that we have verified that a requester is the requesting Consumer or the Consumer’s authorized agent. If you are unable to meet that standard, we will automatically treat the request as a “categories” request and apply the lower verification standard notice above.

In addition, consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, driver’s license number, or other government-issued identification number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a CCPA request.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant for the twelve-month period prior to the request.

“Do Not Sell” Rights

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law.

We do not believe that we sell California Consumer PI as defined under the CCPA and do not offer a “do not sell my personal information” request option. Accordingly, we will not sell PI of California Consumers collected when we did not offer a “do not sell” optout without prior, express consent.

Although there is not yet an industry consensus, we do not believe that the collection of data by third-party cookies and other technologies on our website and online services is a sale of your personal information by us. However, we offer users the ability to opt-out of all cookies associated with our website that are unnecessary for website operations, which includes interest-based advertising cookies and other cookies that might collect your PI and use it or share it with others for purposes that are not necessary to provide us with services. You can exercise that optout by clicking on “cookie preferences” on the banner that appears when you first visit our site. See also our Privacy Policy for certain choices you have regarding cookies, including the use of your browser settings.

Whether you use our cookie management tool, browser settings, or other third-party tools to exercise certain cookie preferences, you will have to exercise cookie preferences using each device you use to access our online services in order for those preferences to be applied to each device, and, if you block or delete cookies, your preferences may not be or remain effective. Blocking cookies may render some features of our site, and third-party sites, inoperable or such sites may not function as intended. As the law and an industry consensus may develop regarding cookies and the CCPA, we will reevaluate our approach to cookies and may change the way we treat cookies and other online tracking technologies.

Some browsers have signals that may be characterized as “do not track” signals, but we do not understand them to operate in that manner or to signify a “do not sell” request. We understand that various parties are developing “do not sell” signals, and we may recognize such signals in the future if we conclude such a program is appropriate.

We do not knowingly sell the PI of Consumers under 16.

Deletion Rights

You may request that we delete your PI that we have collected directly from you. Under the CCPA, we may decline to delete your PI under certain circumstances: for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims. Note also that we are not required to delete your PI that we did not collect directly from you. We require a reasonable or high degree of certainty that the requester is the Consumer for which a deletion request is applicable, depending on the sensitivity of the PI.

Non-Discrimination

California Consumers have the right not to receive discriminatory treatment for the exercise of any of the privacy rights conferred by the CCPA. As of the Effective Date of this California Notice, we did not offer any programs requiring you to limit any of your CCPA rights, or otherwise require you to limit your CCPA rights in connection with charging a different price or rate, or offering a different level or quality of good or service in connection with the collection, use, or retention of PI. If we do so, participation will be optional and we will provide notice of program terms describing the material aspects of any such program and the rights of California participants.

Other California Privacy Rights

We do not share personal information as defined by California Civil Code Section 1798.83 (the “Shine the Light” law) with third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law by emailing us here or by sending a letter to BakerHostetler: One Cleveland Center, 1375 East 9th Street Suite 2100, Cleveland, OH 44114-1794, (Attention: Privacy Inquiry). Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address or mail address.

Please note that “Shine the Light” rights and CCPA rights are established under different legal regimes and must be exercised separately.

When you visit our online services, we and third parties may use tracking technologies to collect usage information based on your device for a variety of purposes, including serving you advertising, based on your having visited our services or your activities across time and third-party locations. Some browsers may enable you to turn on or off a so-called “Do Not Track” signal. Because there is no industry consensus on what these signals should mean and how they should operate, we do not look for or respond to “Do Not Track” signals. For more information on tracking and targeting and your choices regarding these practices, see our online Privacy Policy. We also offer a cookie management tool that enables you to exercise certain cookie preferences, available by clicking on the “cookie preferences” link on the banner that appears when first accessing any of our online services. Whether you use our cookie management tool, browser settings, or other third-party tools to exercise certain cookie preferences you will have to exercise cookie preferences using each device you use to access our online services in order for those preferences to be applied to each device, and, if you block or delete cookies, your preferences may not be or may not remain effective. Blocking cookies may cause some features of our site, and third-party sites, to fail to be available or to function as intended.

CONTACT US

For more information regarding your California privacy rights, please contact BakerHostetler by email here, call us at (888) 914-9661 PIN 530 983, or send a letter to BakerHostetler at: One Cleveland Center, 1375 East 9th Street Suite 2100, Cleveland, OH 44114-1794, (Attention: Privacy Inquiry).