Skip Repeated Content

Did California Declare War on Attorney Client Privilege? How the CCPA Impacts Privilege Protections

March 26, 2019

The hastily drafted CCPA raises serious issues concerning the attorney-client privilege, work-product doctrine, and client confidentiality.  Drafted in approximately one-week as a political compromise to address a proposed privacy ballot initiative,1 the CCPA contains provisions that are all too unclear regarding an attorney’s obligations to maintain client confidentiality and privilege.  Without further clarification from the legislature or the California Attorney General’s rulemaking process, this lack of clarity is likely to lead to litigation.

The crux of the problem lies in the CCPA’s broad reach and its vaguely worded exemptions.  The CCPA confers an obligation upon businesses (a term which could apply to many law firms and their corporate clients depending upon the factual circumstances) to provide privacy notices to individuals about whom information is collected, to provide individuals with access to information held about them, and, in some instances, to delete information about individuals upon their request.  As it is currently written, the CCPA contains an exemption which states that the “obligations imposed on businesses by Sections 1798.110 to 1798.135 [of the CCPA], inclusive, shall not apply where compliance by the business with the title would violate an evidentiary privilege under California law . . . .”2  While the legislature presumably intended to ensure that the CCPA did not require a business or its outside counsel to disclose privileged information, on its face the exemption is limited only to the obligations imposed by “Sections 1798.110 to 1798.135.”  It expressly does not apply to obligations imposed by other sections of the CCPA, such as Sections 1798.100 or 1798.105. 

Sections 1798.100 and 1798.105 are particularly relevant when it comes to attorney-client privilege, work-product, and client confidentiality.  Section 1798.100 contains within it the requirement that a business must, in response to an access request, "provide” to a consumer “specific pieces of personal information the business has collected” about the individual.3  Section 1798.105 contains within it the requirement that a business must, in response to a valid deletion request, "delete the consumer's personal information from its records. . . ."4  The net result is that the statute does not on its face prevent a California resident from requesting that an attorney, or a business, disclose privileged, work-product, or confidential information that relates to the California resident, nor does it prevent the California resident from requesting that a law firm (or its client) delete privileged information that relates to the individual. 

Other more general exemptions to disclosure in the CCPA could arguably apply, although it is unclear whether the legislature intended that these exemptions cover privileged, work-product, and confidential information of a client.  For instance, Section 1798.145(j) states that none of the “rights afforded to consumers and the obligations imposed on the business” should “adversely affect the rights and freedoms of other consumers,” while Section 1798.145(a)(1) provides “the obligations imposed on businesses by this title shall not restrict a business’s ability to … [c]omply with federal, state, or local laws.”5  A business or law firm faced with the question of whether it must disclose privileged, work-product, or confidential information may turn to these sections to argue that the CCPA should not supersede other state laws concerning privilege, work-product, or an attorney’s ethical obligations to maintain client confidentiality.6  However, a consumer seeking disclosure of the information may conversely argue the more specific should govern over the general.  Because the specific exemption concerning evidentiary privileges (such as privilege) expressly does not apply to all sections of the CCPA, so the argument goes, these other more general exemptions should not apply either. 

As a result of the lack of clarity in the statute, Bryan Cave Leighton Paisner, LLP has specifically requested that the California Attorney General issue rulemaking clarifying that privileged, work-product, and confidential information of a client is exempt from disclosure under all of the provisions of the CCPA.  Without rulemaking from the Attorney General or further clarification from the legislature, the CCPA otherwise leaves important issues that lie at the heart of the attorney-client relationship to the uncertainties of litigation. 


1. For a further discussion of the history of the CCPA, please see page 2 of Bryan Cave Leighton Paisner, LLP’s Practical Guide to the CCPA .

2. Cal. Civil Code § 1798.145(b).

3. Cal. Civil Code § 1798.100(a), (c), (d).

4. Cal. Civil Code § 1798.105(c).

5. Cal. Civil Code §§ 1798.145(j), 1798.145(a)(1). 

6. See Cal. Evid. Code § 954 (concerning attorney-client privilege); Cal. Code Civ. Proc. § 2018.010 et seq. (concerning attorney work-product); Cal. Rule of Professional Conduct 3-100 (concerning an attorney’s obligation not to reveal confidential information of a client). 

This document provides a general summary and is for information/educational purposes only. It is not intended to be comprehensive, nor does it constitute legal advice. Specific legal advice should always be sought before taking or refraining from taking any action.