Agreed to a Data Processing Addendum that Complied with the CCPA? Will a New Addendum Be Needed?
“It depends,” advises David A. Zetoony in The National Law Review.
“To the extent that a service provider agreement, or a data processing addendum, already prohibits a service provider from ‘disclosing’ personal information for ‘any purpose’ other than what is specified in the agreement, and the agreement does not specify that the service provider can sell or share information for targeted advertising, it’s not clear that the agreement would need to be amended to specifically state that in addition to not disclosing personal information the service provider may not sell or share it (as selling or sharing would be a form of disclosure). To the extent, however, that an agreement that was drafted under the CCPA prohibited the general disclosure of personal information, but specified that, notwithstanding the general prohibition, a service provider could share it for cross-context advertising, the agreement might need to be amended to prohibit such disclosures in order to make clear that any transfer of information is being done on behalf of the business.
