South Carolina Federal Court Denies Dismissal of CCPA Claims in Class Action

Written by: Alyssa Feliciano, Esq.

A federal judge in South Carolina denied a motion to dismiss claims in a class action lawsuit brought under the California Consumer Privacy Act (“CCPA”). The class action suit was brought against Blackbaud, following a ransomware attack in early 2020 that left countless individual’s data compromised.  Blackbaud attempted to have the CCPA claims dismissed, stating that they fail as a matter of law because Blackbaud is not a “business” regulated by the Act.  The judge rejected this argument, instead determining that Plaintiffs adequately assert that Blackbaud constitutes a “business” under the CCPA, and they sufficiently allege violations of the CCPA. The decision hinged on how a “business” is defined under the CCPA, which the judge clarified in the analysis.

The CCPA defines a “business” as a for-profit entity that:

1. 1. Is organized or operated for the profit or financial benefit of its shareholders or other owners that collects consumers’ personal information on the behalf of which that information is collected.
   2. Alone, or jointly with others, determines the purposes and means of the processing of consumers’ personal information.

The following thresholds must also be met to qualify as a “business” under the CCPA:

1. 1. Have annual gross revenues more than $25 million;
   2. Annually buy, receive, sell, or share the personal information of 50,000 or more consumers, households, or devices; or
   3. Earn more than half of its revenue from selling consumers’ personal information

Plaintiffs were able to successfully demonstrate that Blackbaud qualified as a “business” in its initial pleadings.  The federal court also rejected Blackbaud’s attempt to distinguish a “service provider” as being outside the scope of a “business” defined under the act, stating that the statutory definition of “service provider” suggests that “business” is a broader term that encompasses “service provider.”