In these California Consumer Privacy Act Disclosures ("CCPA Disclosures"), we, Baker & McKenzie LLP and other members and affiliates of Baker & McKenzie International (collectively "Baker McKenzie") disclose information about our data processing practices as required by the California Consumer Privacy Act of 2018 ("CCPA") and supplement the disclosures in any CCPA Notice at Collection issued in addition to the CCPA Notice at Collection Online provided in Section III below. These CCPA Disclosures are effective January 1, 2020.

>> Download a pdf version of the CCPA Disclosures 

I. Who and what information is subject to these CCPA Disclosures?

California residents are protected as “consumers” by the CCPA with respect to personal information. A number of statutory exceptions apply under the CCPA and to these CCPA Disclosures, including the following:

  1. personal information reflecting a written or verbal communication or a transaction between the business and the consumer, where the consumer is a natural person who is acting as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, non-profit, or government agency and whose communications or transaction with the business occur solely within the context of the business conducting due diligence regarding, or providing or receiving a product or service to or from such company, partnership, sole proprietorship, non-profit, or government agency.
  2. personal information that is collected by a business about a natural person in the course of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the natural person’s personal information is collected and used by the business solely within the context of the natural person’s role or former role as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or a contractor of that business.
  3. personal information that is collected by a business that is emergency contact information of the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the personal information is collected and used solely within the context of having an emergency contact on file.
  4. personal information that is necessary for the business to retain to administer benefits for another natural person relating to the natural person acting as a job applicant to, an employee of, owner of, director of, officer of, medical staff member of, or contractor of that business to the extent that the personal information is collected and used solely within the context of administering those benefits.

II. How can a consumer with a disability access these CCPA Disclosures?

Consumers who have a visual disability may be able to use a screen reader or other text-to-speech or text-to-Braille tool to review the contents of this notice.

III.  CCPA Notice at Collection Online

In this CCPA Notice at Collection Online, we are addressing disclosure requirements under California Civil Code §1798.100(b) and California Attorney General Regulations § 999.305 at or before the point of online collection: We collect the categories of personal information about consumers for the business and commercial purposes set out in our CCPA Privacy Policy which is available below.

IV.  CCPA Privacy Policy

Beyond the disclosures in the preceding “Notice At Collection Online” segment and any other Notice at Collection, we are providing additional disclosures about consumer rights and our personal information handling practices in the preceding twelve months, as required by the CCPA and regulations of the California Attorney General, including §999.308 (Privacy Policy).

1. Right to Know About Personal Information Collected, Disclosed, or Sold
This CCPA Privacy Policy describes personal information we generally collect, use, disclose and sell about California residents. You have the right to request that we disclose what personal information we collect, use, disclose and sell about you specifically (“right to know”). To submit a request to exercise the right to know, please fill in this form or submit an email request to dataprivacy@bakermckenzie.com and include “California Request to Know” in the subject line. Please specify in your request the details you would like to know, including any specific pieces of personal information you would like to access.

We will ask that you provide certain information to verify your identity, such as a code sent to an email address we may have on file for you. If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. We will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.

2. Our Personal Information Handling Practices in 2019
We have set out below categories of personal information we have collected about California residents in the preceding 12 months and, for each category of personal information collected, the categories of sources from which that information was collected, the business or commercial purposes for which the information was collected, and the categories of third parties with whom we shared the personal information.

 

Section Category of personal information We collected such personal information to use for the following business or commercial purposes: We have collected such personal information from the following categories of sources:
We shared such personal information with the following categories of third parties:
1 Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

Clients/job applicants/other third parties
To provide legal advice, business, services and to respond to inquiries.

To manage our business operations and administer our client relationship.

To provide relevant marketing to you (e.g. information about events or services that may be of interest. 

To address compliance and legal obligations (e.g. checking identity of new clients, prevention of fraud/money laundering).

To consider individuals for employment and contractor opportunities and manage on-boarding procedures.

Employees
Administering and providing compensation, benefits and other work related allowances.

Administering the workforce (e.g. managing work activities, performance evaluations and promotions, preparing corporate organisation charts, managing entity and intra-entity staffing and team management, managing and monitoring business travel, carrying out workforce analysis, talent management and career development, managing employee leave, succession planning, providing employment references, administering ethics and compliance training, facilitating and providing services for the re-location and movement of employees and their families locally and internationally.

Complying with employment law obligations.

Subject to applicable laws, monitoring use of the firm's technology systems, databases and property, conducting investigations.

Administration of the compliance hotline.

Communicating with employees and their designated contacts in the event of an emergency.

Responding to legal and/or regulatory requests for information.

Complying with corporate financial responsibilities (audit, accounting and tax requirements).

Managing corporate information technology (e.g. IT support, corporate directory, IT security).

Conducting security screenings (to the extent permitted by law)

Internet Protocol Address
See section 6 below for details.

From the data subject, our affiliates, counterparties to transactions or disputes with the data subjects, employers,  agents or professional advisers authorised to disclose data on behalf of the data subject and from other publicly available or subscription based sources.

Baker McKenzie Affiliates (i.e. member firms and global services companies)

Suppliers and service providers where necessary to perform functions on our behalf (e.g. infrastructure/IT services providers, providers of services relating to client intake, global travel, finance, customer relationship management, business analytics and marketing and conference and event hosting).

Financial institutions (for invoicing and payment).

Corporate purchasers - as part of any sale of Firm assets, transition of service to another provider or in the event of insolvency, bankruptcy or

Mandatory disclosures and legal claims (e.g. to comply with any subpoena, court order or other legal process or to comply with any regulatory, governmental or other legally binding request).

2 Any categories of personal information described in subdivision (e) of Section 1798.80: “Personal information” means any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. “Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.” See section 1 above. See section 1 above. See section 1 above.
3 Characteristics of protected classifications under California or federal law (classes include race, color, religion, national origin, sex (including pregnancy, childbirth, and related medical conditions), disability, leave, age, citizenship status, genetic information, ancestry, breastfeeding, marital status, gender identity, gender expression, sexual orientation, medical condition including AIDS/HIV, political activities and affiliations, military and veteran status, and status as a victim of domestic violence, assault, or stalking).

Solely as strictly necessary for the purposes described in section 1 above regarding employee data and as otherwise required in connection with managing the employment relationship (e.g. sick leave, sick pay, accidents at work, other employment related claims, accommodating disability within the workplace, maternity leave, etc.).

Solely to the extent required to comply with the firm's legal or other best practice obligations (e.g. AML, equality laws, monitoring diversity and inclusion, etc.).

See section 1 above.

Baker McKenzie Affiliates (i.e. member firms and global services companies)

Suppliers and service providers where necessary to perform functions on our behalf.

Mandatory disclosures and legal claims (e.g. to comply with any subpoena, court order or other legal process or to comply with any regulatory, governmental or other legally binding request).

4 Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. See section 1 above. See section 1 above. See section 1 above.
5 Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.

To make our website more intuitive and easy to use. 

To protect the security and effective functioning of our website.

Via the Firm's website.

To our service providers to the extent necessary for the provision of IT services on our behalf.

Baker McKenzie Affiliates (i.e. member firms and global services companies).

6 Audio, electronic, visual, thermal, olfactory, or similar information.

Audio/visual - where required for legal/regulatory reasons, to keep a record of client instructions or other matters discussed. For purpose of transcribing or preparing a written note of client interviews (recording deleted once transcript or note completed).

Conference calls and video conferences with clients and other third parties.

Interviews with clients as part of client feedback program.

Baker McKenzie Affiliates (i.e. member firms and global services companies).

To our service providers to the extent necessary for the provision of IT services on our behalf.

Mandatory disclosures and legal claims (e.g. to comply with any subpoena, court order or other legal process or to comply with any regulatory, governmental or other legally binding request).

7 Professional or employment-related information. See section 1 above in relation to employees and job applicants. See section 1 above in relation to employees and job applicants. See section 1 above in relation to employees and job applicants.
8 Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99). See section 1 above in relation to employees and job applicants. See section 1 above in relation to employees and job applicants. See section 1 above in relation to employees and job applicants.

 

3. Disclosures of Personal Information, No Sale
Over the preceding 12 months, we disclosed certain categories of California residents’ personal information to the categories of third parties as shown in the table above. We do not and will not sell California residents’ personal information. We do not sell the personal information of minors under 16 years of age without affirmative authorization.

4. Right to Request Deletion of Personal Information
You have a right to request the deletion of personal information that we collect or maintain about you. To submit a request to delete personal information, please fill in this form or submit an email request to dataprivacy@bakermckenzie.com and include “California Request to Delete” in the subject line. Please specify in your request the personal information about you that you would like to have deleted, which can be all of your personal information as required by the CCPA.

We will ask that you provide certain information to verify your identity, such as a code sent to an email address we may have on file for you. If you have a password-protected account with us, we may verify your identity through our existing authentication practices for your account. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. Once we have verified your identity, we will ask you to confirm that you wish to have your personal information deleted. Once confirmed, we will respond to your request in accordance with the CCPA. If we deny your request, we will explain why.

5. Right to Opt-Out of the Sale of Personal Information
You have the right to opt-out of the sale of your personal information by a business. We do not, and will not, sell your personal information.

6. Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights
You may not be discriminated against because you exercise any of your rights under the CCPA in violation of Cal. Civ. Code §1798.125. 

7. Authorized Agent
You can designate an authorized agent to make a request under the CCPA on your behalf if:
  • The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and
  • You sign a written declaration that you authorize the authorized agent to act on your behalf.

If you use an authorized agent to submit a request to exercise your right to know or your right to request deletion, please have the authorized agent take the following steps in addition to the steps described in Sections 2 and 3 above:

  • Mail a certified copy of your written declaration authorizing the authorized agent to act on your behalf to dataprivacy@bakermckenzie.com; and
  • Provide any information we request in our response to your email to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.

If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.

8. Contact for More Information
If you have questions or concerns regarding our privacy policy or practices, you may contact us using the following details:

Email address:
dataprivacy@bakermckenzie.com

Postal address:
Office of General Counsel - Data Privacy
Baker & McKenzie Global Services NI Limited 
City Quays One, 7 Clarendon Road, Belfast, BT1 3BG, United Kingdom

Last Updated: January 1, 2020