California Privacy Notice

Effective Date: January 1, 2020

This notice reflects our good faith understanding of the California Consumer Privacy Act (the “CCPA”) and our data practices as of January 1, 2020, but the CCPA’s implementing regulations are not yet final, and there remain differing interpretations of the law. Accordingly, we may update information regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to Baker & Hosteler LLP’s (“BakerHostetler” “us” “we” “our”) other privacy policies or notices. In the event of a conflict between any other BakerHostetler policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the California law. Please see also any general privacy policy or notice posted or referenced on our websites, apps, products, or services including, without limitation our online Privacy Policy.

This Notice covers our collection, use, disclosure, and sale of California Consumers’ “Personal Information” (“PI”) as defined by the CCPA, except to the extent such PI is exempt from the notice obligations of the CCPA for the twelve months preceding the Effective Date. As a law firm, much of the data we collect and process is not subject to CCPA Consumer rights. Without limiting the foregoing:

  • Consistent with the CCPA, job applicants, current and former employees, and independent contractors, other than prospective, current, and former partners of BakerHostetler (“Personnel”), and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business are not considered “Consumers” for purposes of this California Privacy Notice or the rights described herein.
  • PI subject to an evidentiary privilege, such as the attorney-client privilege and/or attorney work product protection, is not subject to Consumer rights to know (Consumer-specific information and copies), delete, or opt-out under the CCPA as described in Section II; however, we do include this PI in the general disclosures in Section I.
  • Publicly available information (as defined by the CCPA) is not PI under the CCPA and not included in the disclosures under Section I and is not data to which Consumers have rights as described in Section II.
 I. COLLECTION AND USE OF PERSONAL INFORMATION

We collect PI about California Consumers, which in the calendar year 2019 included the following:

Category Examples of PI Collected Sources of PI Purposes for PI Collection Categories of Recipients

Identifiers

Name, postal address, email address, identification numbers From the Consumer, Clients, Service Providers, Government Entities, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to contact you, to verify your identity, to provide services, and to comply with our legal obligations.
Clients, Government Entities, Tribunals, and Service Providers

Personal Records

Name, postal address, telephone number, email address From the Consumer, Clients, Government Entities, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security

For example, these purposes include business management and planning, to provide services, and to comply with our legal obligations.

Clients, Data Subjects, Government Entities, Tribunals, and Service Providers
Personal Characteristics or Traits Marital / familial status, race, religion, disabilities From the Consumer, Clients, Government Entities, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services;
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to provide benefits to our partners, and services to our clients.
Clients, Data Subjects, Government Entities, Tribunals, and Service Providers
Commercial Information / Account Details Purchase history or tendencies From the Consumer, Clients, Government Entities, Service Providers, and Third Parties.
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development;
  • Quality Assurance; and
  • Security
For example, these purposes include to provide benefits to our partners and services to our clients.
Clients, Data Subjects, Government Entities, Tribunals, and Service Providers

Internet Usage Information

Information regarding interactions with our website, computer systems, and/or devices From the Consumer, Service Providers and Third Parties.
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development;
  • Quality Assurance;
  • Security; and
  • Debugging
For example, these purposes include to improve our services, including providing users more relevant content, and to secure our network and protect our personnel.
Service Providers

Professional or Employment Information

Job title, employer, practice area or industry focus From the Consumer, Clients, Government Entities, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development; and
  • Quality Assurance
For example, these purposes include to provide benefits to our partners and to market them to clients and prospective clients.
Clients, Data Subjects, Government Entities, Tribunals, Service Providers, and the General Public
Inferences from PI Collected Customer profiles reflecting preferences From the Consumer, Service Providers, and Third Parties
  • Processing Interactions and Transactions;
  • Managing Interactions and Transactions;
  • Performing Services
  • Research and Development; and
  • Quality Assurance

For example, for business management and planning and to provide services.

Service Providers

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat de-identified data or aggregate consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate consumer information.

We may share your PI with our Service Providers, including those that facilitate advertising and marketing, and other categories of recipients as described in the table above, for the same purposes as the collection purposes set forth in that chart. Subject to the CCPA’s restrictions and obligations, our Service Providers also may use your PI for some or all of the above-listed business purposes. Our Service Providers may themselves engage service providers or subcontractors to enable them to perform services for us; such subprocessing is an additional business purpose for which we are providing you notice.

BakerHostetler does not believe it has sold (as the term “sale” is defined by the CCPA) Consumer PI in 2019. As the law evolves we may revisit this conclusion and, if applicable, revise this Notice. See Section II below regarding our current conclusion that data collection by third-party cookies associated with our web sites is not a sale under the CCPA.

II. CALIFORNIA PRIVACY RIGHTS

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process, which will depend on the nature of the request and the PI requested and will be further explained in response to a request. We will not fulfill your CCPA request unless you have provided sufficient information for us to be satisfied that you are the Consumer about whom we collect the applicable PI. Please promptly respond to any follow-up inquiries so that we may verify your identity. If you request that we provide you with specific pieces of information about you, or that we delete sensitive PI, we may apply heightened verification standards than what we would apply to other types of requests. Authorized agents who meet the agency requirements of the CCPA may submit requests on behalf of Consumers, which will also be subject to a verification process.

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about Consumers for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. We will use PI provided in your request only to verify your identity or authority to make the request and as necessary to track and document requests and responses, unless you also provided the PI to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, use, store, disclose, or otherwise process and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may provide you with a summary of your PI and give you the opportunity to elect whether you want us to provide the entire data set. Alternatively, we may direct you on how to access and copy responsive PI yourself. We may charge a reasonable fee or refuse to act upon a request if the request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may decline to comply with the request, we will give you notice explaining why we made that decision. In the case of a fee, we will provide a cost estimate and the opportunity to accept such fees before charging you for responding to your request.

We may collect, use, and disclose your PI as required or permitted by applicable law, and this may override your CCPA rights. Please also note we are not obligated to comply with Consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s rights, or conflict with applicable law.

Your California Consumer privacy rights are described below. To make a request, contact us here or call us at (888) 914-9661 Extension PIN: 530 983 and provide us with your name, e-mail address, phone number, the nature of your inquiry, and, if you are disabled, any accessibility accommodations you require.

Disclosure Rights

i. Information Rights

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

  1. The categories of PI we have collected about you.
  2. The categories of sources from which we collected your PI.
  3. The business or commercial purposes for our collecting or selling your PI.
  4. The categories of third parties to whom we have shared your PI.
  5. The specific pieces of PI we have collected about you.
  6. A list of the categories of PI disclosed for a business purpose in the prior twelve months, or that no disclosure occurred.
  7. A list of the categories of PI sold about you in the prior twelve months, or that no sale occurred. If we sold your PI, we will explain:
    1. The categories of your PI we have sold.
    2. The categories of third parties to which we sold PI, by categories of PI sold for each third party.

For your specific pieces of information, as required by the CCPA, we will apply the heightened verification standards set forth in subsection (ii) below and may exclude that information if you cannot meet those standards. If we cannot verify you to a reasonable degree of certainty, we will not deliver the category information either but will refer you to the disclosures in Section I above.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back twelve months prior to the request.

ii. Obtaining Copies of PI

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is twelve months prior to the request date and are maintaining. In order to protect the privacy and data security of Consumers, we will require a high degree of certainty that we have verified that a requester is the requesting Consumer or the Consumer’s authorized agent. In addition, consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, driver’s license number, or other government-issued identification number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a CCPA request.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back twelve months prior to the request.

“Do Not Sell” Rights

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law.

We do not believe that we sell California Consumer PI as defined under the CCPA. Until such time as we change our practices and update this Privacy Notice, we will treat PI collected under this Notice as subject to a “do not sell” request. However, although there is not yet an industry consensus, we do not believe that the collection of data by third-party cookies and other technologies on our website and online services is a sale of your personal information by us. See our Privacy Policy for certain choices you have regarding cookies. We also offer a cookie management tool that enables you to exercise certain cookie preferences, available when accessing any of our online services.You will have to exercise cookie preferences using each device you use to access our online services in order for those preferences to be applied to each device, and, if you block or delete cookies, your preferences may not be or remain effective. As the law and an industry consensus may develop regarding cookies and the CCPA, we will reevaluate our approach to cookies and may change the way we treat cookies and other online tracking technologies.

Some browsers have signals that may be characterized as “do not track” signals, but we do not understand them to operate in that manner or to signify a “do not sell” request. We understand that various parties are developing “do not sell” signals, and we may recognize such signals in the future if we conclude such a program is appropriate.

We do not knowingly sell the PI of Consumers under 16.

Deletion Rights

You may request that we delete your PI that we have collected directly from you. Under the CCPA, we may decline to delete your PI under certain circumstances, for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims. Note also that we are not required to delete your PI that we did not collect directly from you. We require a reasonable or high degree of certainty that the requester is the Consumer for which a deletion request is applicable, depending on the sensitivity of the PI.

Non-Discrimination

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

Other California Privacy Rights

We do not share personal information as defined by California Civil Code Section 1798.83 (“Shine the Light law”) with third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law by contacting us here or by sending a letter to BakerHostetler: One Cleveland Center, 1375 East 9th Street Suite 2100, Cleveland, OH 44114-1794, (Attention: Privacy Inquiry). Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address or mail address.

When you visit our online services, we and third parties may use tracking technologies to collect usage information based on your device for a variety of purposes, including serving you advertising, based on your having visited our services or your activities across time and third-party locations. Some browsers may enable you to turn on or off a so-called “Do Not Track” signal. Because there is no industry consensus on what these signals should mean and how they should operate, we do not look for or respond to “Do Not Track” signals. For more information on tracking and targeting and your choices regarding these practices, see our online Privacy Policy. We also offer a cookie management tool that enables you to exercise certain cookie preferences, available when accessing any of our online services.

Please note that “Shine the Light” rights and CCPA rights are established under different legal regimes and must be exercised separately.

CONTACT US

For more information regarding your California privacy rights, please contact BakerHostetler here, call us at (888) 914-9661 PIN 530 983, or send us a letter to BakerHostetler: One Cleveland Center, 1375 East 9th Street Suite 2100, Cleveland, OH 44114-1794, (Attention: Privacy Inquiry).