Award Mouse thought multimedia interface book medal screen monitor

California Consumer Privacy Act - Privacy Policy Applicable to Client-Related Personal Information

Download printer friendly version


Effective date: January 1, 2022

California Privacy Notice

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act ("CCPA") as a supplement to other Squire Patton Boggs (“SPB,” “we,” “us,” “ours”) privacy policies or notices.  In the event of a conflict between any other SPB policy, statement or notice, this Notice will prevail as to California Consumers and their rights under California law.

Individuals who have a visual disability may be able to use a screen reader or other text-to-speech or text-to-Braille tool to review the contents of this Notice.  If you require additional assistance, contact us at 877.381.1109, clearly leave your name, contact information, and the nature of you inquiry, and request a call back to address disability assistance.

Section 1 of this Notice covers our collection, use, disclosure, and sale of California Consumers’ “Personal Information” or “PI” as defined by the CCPA for 2021, except to the extent the PI is exempt from the CCPA’s notice obligations, and will be updated annually.  Section 2 of this Notice describes the rights of California Consumers. 

As a law firm, much of the data we collect and process is not subject to CCPA Consumer rights.  Without limiting the foregoing:

  • Consistent with the CCPA, job applicants, current and former employees, and independent contractors (other than prospective, current, and former partners of SPB) (“Personnel”), and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business, are not considered “Consumers” for purposes of this Notice or the rights described herein.
  • PI subject to an evidentiary privilege, such as the attorney-client privilege and/or attorney work product protection, is not subject to the rights available to California Consumers as described in Section 2; however, we do include this PI in the general disclosures in Section 1.
  • Publicly available information (as defined by the CCPA) is not PI under the CCPA.  It is not included in the disclosures in this Notice and is not data to which Consumers have rights described in Section 2.

To aid in readability, in some places we have abbreviated or summarized CCPA terms or language, and in some places in this Notice we cite to specific CCPA sections for your reference.  Terms defined in the CCPA that are used in this Notice shall have the same meaning as in the CCPA.

  1. Collection, Use, and Sharing of PI

In 2021, we collected, retained, used, and disclosed PI about California Consumers as set forth below.  This also serves as our pre-collection notice, unless supplemented by another notice at collection.

CCPA PI Categories and Examples:

Sources of PI:

Categories of Recipients:

Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, government identification numbers, or other similar identifiers

  • Consumers directly
  • Government entities
  • Clients or prospective clients
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers (e.g., credit vetting agencies and background check firms) and legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks)

Business Purpose Disclosure:

  • Service providers (e.g., credit vetting agencies and background check firms)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local Counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Other records, such as signatures, ID cards, and bank account or other financial information

  • Consumers directly
  • Government entities
  • Clients or prospective clients
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers (e.g., credit vetting agencies and background check firms) and legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks)
  • Business Purpose Disclosure:
  • Service providers (e.g., document review service providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Protected class and demographic information, such as age, race, ethnicity, color, ancestry, national origin, citizenship, religion or creed, marital status, gender (including gender, gender identity, gender expression), pregnancy or childbirth information, medical or disability conditions, sexual orientation, and veteran or military status

  • Consumers directly
  • Clients
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers (e.g., credit vetting agencies and background check firms) and legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks)

Business Purpose Disclosure:

  • Service providers (e.g., data room administrators, document review service providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Commercial information, such as records of services obtained or considered from us

  • Consumers directly
  • Government entities
  • Clients or prospective clients
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers

Business Purpose Disclosure:

  • Service providers (e.g., e-billing and matter management platform service providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Internet or other electronic network activity information, such as browsing history; search history; and information regarding a Consumer’s interaction with an internet website, application, advertisement, computer, system, or other device (excluding identifiers as described in “identifier” category above, e.g., IP Addresses)

  • Consumers directly
  • Clients or prospective clients
  • Third parties such as service providers

For more information on internet usage information we may collect when you visit our site or interact with us online, see our Global Website Privacy Notice and Cookie Notice.

Business Purpose Disclosure:

  • Service providers (e.g., IT service providers, data room administrators)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Geolocation (e.g., approximate location of a device or equipment)

  • Consumers directly
  • Third parties such as service providers

Business Purpose Disclosure:

  • Service providers (e.g., IT services providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)

Sale:

  • Not Sold

Audio, electronic, visual, or similar sensory information, such as video recordings or conference call recordings

  • Consumers directly
  • Clients or prospective clients (e.g., we may record a conference call or an event where you participate)
  • Clients’ representatives or adverse parties (e.g., as part of discovery in a case we are litigating)
  • Third parties such as service providers

Business Purpose Disclosure:

  • Service providers (e.g., telecommunications operators and security vendors)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Professional or employment-related information, such as business contact details, job title or position, company affiliation, company address, practice area, or industry focus)

  • Consumers directly
  • Clients or prospective clients (e.g., business contact information when you request copies of our newsletters, client alerts or blogs, or register to attend seminars, online webinars and similar events offered by us)
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers and legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks), or business contact details of our vendor’s individual account representatives

Business Purpose Disclosure:

  • Service providers (e.g., marketing and event management platforms)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Educational records, such as files, documents, and other materials which contain information directly related to a student (such as grades or transcripts)

  • Consumers directly
  • Third parties such as colleges and universities
  • Our clients or individuals associated with our clients or adverse parties where relevant to the legal issues involved (e.g., in connection with litigation matters involving an educational institution)

Business Purpose Disclosure:

  • Service providers (e.g., data room administrators, document review service providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

Inferences drawn from any of the PI identified above to create a profile about a Consumer reflecting the Consumer’s preferences or characteristics

  • Consumers directly
  • Clients or prospective clients
  • Clients’ representatives
  • Adverse parties
  • Third parties such as service providers (e.g., credit vetting agencies and background check firms) and legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks)

We may draw inferences from information that we have received (such as, we may draw inferences from evidence received from or on behalf of our clients in legal proceedings; we may conclude that you are interested in receiving updates from us on developments in particular areas if you have attended firm-sponsored events; or we may conclude that applicable laws prohibit us from engaging with a prospective client based on information obtained through our Know-Your-Client compliance procedures)

Business Purpose Disclosure:

  • Service providers (e.g., IT or marketing service providers)
  • Governmental entities (where we are under a duty to disclose or as required to protect our rights or the rights of others)
  • Client representatives
  • Local counsel, co-counsel, opposing counsel, courts and arbitration panels
  • Other third parties as necessary to provide legal services to our clients

Sale:

  • Not Sold

The chart above reflects those categories of PI required to be addressed by the CCPA.  There may be additional information that we collect that meets the CCPA’s definition of PI but is not reflected by a category, in which case we will treat it as PI as required by the CCPA, but will not include it when we are required to describe our practices by category of PI.

As permitted by applicable law, we do not treat de-identified data or aggregate Consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate Consumer information, and may elect not to treat publicly available information as PI.  We have no obligation to re-identify information or keep it longer than we need it to respond to your requests.

Purposes for PI Collection:

  • Performing services: (§1798.140(d)(5))
  • Managing interactions and transactions: (§1798.140(d)(1))
  • Security: (§1798.140(d)(2))
  • Debugging to repair errors: (§1798.140(d)(3))
  • Processing interactions and transactions: (§1798.140(d)(4))
  • Quality/safety maintenance: (§1798.140(d)(7))

Additional business purposes include i) sharing PI with third parties for purposes other than a sale, or ii) one of the foregoing business purposes as required or permitted by applicable law (such as to our vendors that perform services for us, to the government or private parties to comply with law or legal process, and to the Consumer or other parties at the Consumer’s request) (“Other Business Purposes”).

Subject to restrictions and obligations of the CCPA, our vendors may also use your PI for some or all of the above listed business purposes.  Our vendors may themselves engage services providers or subcontractors to enable them to perform services for us, which sub-processing is, for purposes of certainty, an Other Business Purpose for which we are providing you notice.

To our knowledge, we do not sell PI of anyone under 16 years of age.

2. California Privacy Rights

If you are a California resident, you have the following rights in relation to the categories of PI described above, as provided under California law:

Subject to legal limitations, certain California residents have the following rights:

  • Right to Know. You have the right to request information about the categories of PI we have collected about you, the categories of sources from which we collected your PI, the purposes for collecting your PI, the categories of third parties with whom we have shared your PI, and the purpose for which we shared your PI (“Categories Report”).  You may also request information about the specific pieces of PI we have collected about you (“Specific Pieces Report”).
  • Right to Delete. You have the right to request that we delete PI that we have collected from you.
  • Right to Opt Out (Do Not Sell My Personal Information). We do not “sell” PI as such term is defined under the CCPA. 

a. How to Submit a Request

To exercise your right to know, or your right to delete, please email us at DataSubjectRequests@squirepb.com and include “Request under CCPA” in the subject line or call us at 877.381.1109 and clearly state your name, contact information, and the nature of your inquiry.

We recommend making your request by email to ensure we capture your contact details and other information accurately.  Please include in your request:

  • Your full name and address
  • Former names (if applicable)
  • Former addresses (including dates of change) (if applicable)
  • Contact information (phone number or email address)
  • Your relationship to us (e.g., former or existing client)
  • Type of request that you are making (e.g., Categories Report, Specific Pieces Report).

We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome.  If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision.  You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.  There may also be reasons to limit our response to your request.  For instance, there may be retention exceptions that limit a right to delete, but if so we will explain the retention purposes and limit our use to those purposes and for only so long as the retention purpose continues.  Consistent with the CCPA’s requirements, to protect your security, we will not deliver certain high risk PI like your social security number to you, but we will describe the PI types not provided for that reason.  We also will not provide PI where disclosure would infringe the rights or privileges of others.  Whenever we limit a response for reasons the law permits we will explain that in our response to you.

b. Verification

In order for us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the Consumer we may have collected PI about or a person who has been duly authorized to make the request on behalf of the Consumer (“Verifiable Consumer Request”).  We will not fulfill your Right to Know or Right to Delete request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.

Right to Know - Categories Request:

We are required to verify a Consumer’s request to know categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by the Consumer with data points maintained by us, which we have determined to be reliable for the purpose of verifying the Consumer.  If we are unable to verify you sufficiently to honor your request, we will refer you to Section 1 this Notice for our categories disclosure with regard to Consumers generally.

Right to Know – Specific Pieces Request:

We are required to verify a Consumer’s request to know specific pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by the Consumer with data points maintained by us, which we have determined to be reliable for the purpose of verifying the Consumer together with a signed declaration under penalty of perjury that the requestor is the Consumer whose PI is the subject of the request.  If we are unable to verify you sufficiently to honor your request, we will consider if you can be verified sufficiently to receive a Categories Report.

Right to Delete Request:

We are required to verify a Consumer’s request to delete to a reasonable degree of certainty, which may include matching at least two data points provided by the Consumer with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by the Consumer with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized deletion.

Some PI we maintain about Consumers is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI when a Consumer request that requires verification pursuant to the CCPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID).  As required by the CCPA, we do not include that PI in response to those requests.  If we cannot comply with a request, we will explain the reasons in our response.  We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

Do not send us identification documents unless requested by us, in which case they should be transmitted to us through the secure means of communication we specify or approve and should be photocopies or scanned images (do not send the originals). 

c. Authorized Agents

Authorized agents may exercise rights on behalf of California Consumers, but we reserve the right to also verify the Consumer directly as described above. Authorized agents may email at us DataSubjectRequests@squirepb.com to exercise rights on the Consumer’s behalf.  We will require the agent to demonstrate authority to act on behalf of the Consumer by providing, for example, evidence of the agent’s identity, proof of registration with the California Secretary of State (if the agent is a business), and at least one of the following evidencing proof of the agent’s legal authority to act on the behalf of the individual Consumer:

  • Presenting a Power of Attorney granted under the Probate Code that we can reasonably verify; or
  • Signed permission by the Consumer.  We may also require the Consumer to verify their own identity directly with us and to directly confirm with us that they provided the authorized agent permission to submit the request.

d. Timing

We will respond to requests to delete and requests to know within 45 calendar days, unless we need more time, in which case we will notify you and may take up to 90 calendar days total to respond to your request.

e. Non-Discrimination

California residents have the right to not be discriminated against for exercising their rights under the CCPA.  We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.  

f. Other California Privacy Rights

We do not share “personal information” subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for the third parties’ direct marketing purposes absent your consent.  If you are a California resident, you may request information about our compliance with the Shine the Light law by emailing us at DataSubjectRequests@squirepb.com.  Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code.  Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address.

3. How to Contact Us

For general questions about this Notice, you may contact us as follows:

By mail:

Assistant General Counsel - CCPA
Squire Patton Boggs (US) LLP
2550 M Street, NW
Washington, DC 20037

By email: DataSubjectRequests@squirepb.com