U.S. State Privacy Notice

Download printer friendly version

Effective date: January 1, 2024

NEW U.S. State Privacy Notice

This U.S. State Privacy Notice (“Notice”) applies to “Consumers” as defined under the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (together, the “CCPA”), the Colorado Privacy Act, the Virginia Consumer Data Protection Act, the Utah Consumer Privacy Act, Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring, Chapter 603A of the Nevada Revised Statutes,Oregon Consumer Privacy Act, Texas Data Privacy and Security Act (“TDPSA”)(effective July 1, 2024), Montana Consumer Data Privacy Act (effective October 1, 2024), and all laws implementing, supplementing or amending the foregoing, including regulations promulgated thereunder (collectively, “U.S. Privacy Laws”).  Capitalized terms used but not defined in this Notice shall have the meanings given to them under U.S. Privacy Laws.

This Notice is designed to meet our obligations under U.S. Privacy Laws and supplements the general privacy policies of Squire Patton Boggs (“Firm,” “our,” “us,” or “we”) or including, without limitation, our Website Privacy Policy. In the event of a conflict between any other Firm policy, notice, or statement and this Notice, this Notice will prevail as to Consumers unless stated otherwise.   

Individuals who have a visual disability may be able to use a screen reader or other text-to-speech or text-to-Braille tool to review the contents of this Notice.  If you require additional assistance, contact us at 877.381.1109, clearly leave your name, contact information, and the nature of you inquiry, and request a call back to address disability assistance.

Applicability:

• Section 1 of this Notice provides notice of our data practices, including our collection, use, disclosure, and sale of Consumers’ Personal Information or Personal Data (collectively, “PI”). It does not apply to our current employees, former employees, or independent contractors (“Personnel”). Our California Personnel can learn about our data practices as relates to them by contacting human resources. Section 1 of this Notice also does not apply to job applicants. California job applicants can learn about our data practices as relates to them by visiting our California Job Applicant Privacy Notice.
• Sections 2-5 of this Notice provide information regarding Consumer rights and how you may exercise them. Section 2 also provides information regarding rights of our California Personnel and job applicants.
• Section 6 of this Notice provides additional information for California residents, other than our Personnel and job applicants.

For California residents the term “Consumer” is not limited to data subjects acting as individuals regarding household goods and services and includes data subjects in a business-to-business context. This is not the case in the other states. 

As a law firm, much of the data we collect and process is not subject to Consumer rights.  Without limiting the foregoing:

• PI subject to an evidentiary privilege, such as the attorney-client privilege and/or attorney work product protection, is not subject to the rights available to Consumers as described in Sections 2-5; however, we do include this PI in the general disclosures in Section 1.
• Publicly available information (as defined by U.S. Privacy Laws) is not PI under U.S. Privacy Laws.  It is not included in the disclosures in this Notice and is not data to which Consumers have rights described in Sections 2-5.

1. Notice of Data Practices
(a) PI Collection, Disclosure, and Retention – By Category of PI
(b) PI Use and Disclosure – By Processing Purpose

2. Your Consumer Rights and How to Exercise Them
(a) Right to Limit Sensitive PI Processing
(b) Right to Know/Access
(1) Categories (available for California Residents Only)
(2) Specific Pieces
(c) Do Not Sell / Share / Target
(d) Right to Delete
(e) Correct Your PI
(f) Automated Decision Making/Profiling
(g) How to Exercise Your Consumer Privacy Rights
(1) Your Request Must be a Verifiable Consumer Request
(2) Agent Requests
(3) Appeals
(h) Our Responses

3. Non-Discrimination/No Retaliation

4. Notice of Financial Incentive Programs

5. Our Rights and the Rights of Others

6. Additional Notice for California Residents
(a) Shine the Light

7. Contact Us

1. NOTICE OF DATA PRACTICES

The description of our data practices in this Notice covers the twelve (12) months prior to the Effective Date and will be updated at least annually. Our data practices may differ between updates, however, if materially different from this Notice, we will provide supplemental pre-collection notice of the current practices, which may include references to other privacy policies, notices, or statements. Otherwise, this Notice serves as our notice at collection. 

We may collect your PI directly from you; your devices; government entities; clients or prospective clients (e.g.,  business contact information when you request copies of our newsletters, client alerts or blogs, or register to attend seminars, online webinars and similar events offered by us; or we may record a conference call or an event where you participate); clients’ representatives; individuals associated with our clients; adverse parties (e.g., as part of discovery in a case we are litigating); legal directories (e.g., records of individuals related to or adverse to our clients to conduct conflict checks); Vendors (defined below) or third parties such as colleges and universities.

Generally, we Process your PI to provide you services and as otherwise related to the operation of our business, including for one or more of the following Business Purposes: Short-term Transient Use, Performing Services; Security; Debugging; Advertising & Marketing; Internal Analytics and Research and Product Development. We may also use PI for other Business Purposes in a context that is not a Sale or Share under U.S. Privacy Laws, such as disclosing it to our Service Providers, Contractors, or Processors that perform services for us (collectively, “Vendors”), to the Consumer or to other parties at the Consumer’s direction or through the Consumer’s action; for the additional purposes explained at the time of collection (such as in the applicable privacy policy or notice); as required or permitted by applicable law; to the government or private parties to comply with law or legal process; and to assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”) (“Additional Business Purposes”). Subject to restrictions and obligations under U.S. Privacy Laws, our Vendors may also use your PI for Business Purposes and Additional Business Purposes, and may engage subcontractors to enable them to perform services for us. 

We provide more detail on our data practices in the two charts that follow. 

(a) PI Collection, Disclosure, and Retention – By Category of PI

We collect, disclose, and retain PI as follows:

There may be additional information we collect that meets the definition of PI under applicable U.S. Privacy Laws but is not reflected by a category above, in which case we will treat it as PI as required, but will not include it when we describe our practices by PI category. 

As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information, and may elect not to treat publicly available information as PI.  We will not attempt to reidentify data that we maintain as deidentified and will similarly restrict those to which we may disclose it.  

Retention of PI: Because there are numerous types of PI in each category, and various uses for each PI type, actual retention periods vary. We retain specific PI pieces based on how long we have a legitimate purpose (e.g., a legal obligation or business purposes) for the retention.  

(b) PI Use and Disclosure – By Processing Purpose 

We use and disclose PI for the processing purposes described below:

Return to Navigation

2. YOUR CONSUMER RIGHTS AND HOW TO EXERCISE THEM

As described more below, subject to meeting the requirements for a Verifiable Consumer Request (defined below), the Firm provides Consumers the privacy rights described in this section. Although we have concluded that only CCPA and TDPSA (as of July 1, 2024) apply to us, we will accept privacy rights requests from all Consumers under U.S. Privacy Laws, subject to our discretion as to how to process non-mandatory requests. For residents of states without Consumer privacy rights, we will also consider requests but will similarly apply our discretion in how we process such requests.  We will also consider applying state law rights prior to the effective date of such laws, but will do so in our discretion. Please note that our Personnel and job applicants and third-party business contacts and subjects of business-to-business communications are only considered Consumers if they are a resident of California when making a request and are not considered Consumers under U.S. Privacy laws other than California’s CCPA law.

To submit a request to exercise your Consumer privacy rights, or to submit a request as an authorized agent, use our U.S. Data Subject Action Request Form or call us at 877.381.1109, and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means (e.g., via email, fax, chats, social media etc.).  More details on the request and verification process is in Section 3.  The Consumer rights we accommodate are as follows:

(a) Right to Limit Sensitive PI Processing

We only Process Sensitive PI for purposes that are exempt from Consumer choice under U.S. Privacy Laws.

(b) Right to Know/Access

Residents of California, Virginia, Colorado, and Texas are entitled to access PI up to twice in a 12-month period.  Residents of Connecticut, Utah, Oregan, and Montana are entitled once every 12-month period to access PI maintained by the Firm, with subsequent requests subject to a service fee. Due to our unique obligations under applicable law (and ethical rules) to our clients, your access to PI included in client materials and work product will be restricted to protect confidentiality of client materials and work product, to preserve legal privileges, etc.     

(1) Categories (available for California Residents Only)

California residents have a right to submit a request for any of the following for the period that is 12-months prior to the request date:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The Business Purposes or Commercial Purposes for our collecting or Selling your PI.
• The categories of third parties to whom we have shared your PI.
• A list of the categories of PI disclosed for a Business Purpose and, for each, the categories of recipients, or that no disclosure occurred.
• A list of the categories of PI sold about you and, for each, the categories of recipients, or that no sale occurred.  

(2) Specific Pieces

You may request to confirm if we are Processing your PI and, if we are, to obtain a transportable copy, subject to applicable request limits, of your PI that we have collected and are maintaining.  For your specific pieces of PI, as required by applicable U.S. Privacy Laws, we will apply the heightened verification standards as described below.  We have no obligation to re-identify information or to keep PI longer than we need it or are required to by applicable law to comply with access requests.  

(c) Do Not Sell / Share / Target

We do not Sell or Share your PI, or Process it for Targeted Advertising, as these terms are defined under U.S. Privacy Laws.  Without limiting the foregoing, we do not knowingly Sell or Share the PI of Consumers under 16.

We may disclose your PI for the following purposes, which are not a Sale or Share:  (i) if you direct us to disclose PI; (ii) to comply with a Consumer rights request you submit to us; (iii) disclosures amongst the entities that constitute the Firm as defined above, or as part of a Corporate Transaction; and (iv) as otherwise required or permitted by applicable law.

Some of the U.S. Privacy Laws require businesses to process GPC signals, which is referred to in California as opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale and Sharing of personal information. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC.  Although we only enable non-essential (i.e., not strictly necessary) cookies if you opt-in to them, we have also configured the settings of our cookie consent management platform to receive and process GPC signals on our website, which is explained by our consent management platform here.  We do not process OOPS/GPC for opt-outs of Sales and Sharing in other contexts (e.g., non-cookie PI) because we do not Sell or Share PI.  We do not: (1) charge a fee for use of our service if you have enabled OOPS/GPC; (2) change your experience with any product or service if you use OOPS/GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the OOPS/GPC.

(d) Right to Delete

Except to the extent we have a basis for retention under applicable law, you may request that we delete your PI. Our retention rights include, without limitation:

• to complete transactions and services you have requested;
• for security purposes;
• for legitimate internal Business Purposes (e.g., maintaining business records or maintaining email addresses of those who have unsubscribed on a marketing suppression list, protecting confidentiality of client materials and work product, to preserve legal privileges, etc.);
• to comply with law and to cooperate with law enforcement; and
• to exercise or defend legal claims.

Note also that, depending on where you reside (e.g., California and Utah), we may not be required to delete your PI that we did not collect directly from you.  

(e) Correct Your PI

Consumers may bring inaccuracies they find in their PI that we maintain to our attention and we will act upon such a complaint as required by applicable law. However, due to our unique obligations under applicable law (and ethical rules) to our clients, your access to PI included in client materials and work product will be restricted to protect confidentiality of client materials and work product, to preserve legal privileges, etc.

(f) Automated Decision Making/Profiling 

We do not engage in Automated Decision Making or Profiling that would require notice or opt-in or opt-out under applicable U.S. Privacy Laws.

(g) How to Exercise Your Consumer Privacy Rights

To submit a request to exercise your Consumer privacy rights, or to submit a request as an authorized agent, use our U.S. Data Subject Action Request Form or call us at 877.381.1109 and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media etc.).  

(1) Your Request Must be a Verifiable Consumer Request

As permitted or required by applicable U.S. Privacy Laws, any request you submit to us must be a Verifiable Consumer Request, meaning when you make a request, we may ask you to provide verifying information, such as your name, e-mail, phone number and/or account information. We will review the information provided and may request additional information (e.g., transaction history) via e-mail or other means to ensure we are interacting with the correct individual. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete, or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.  

We verify each request as follows:

• Right to Know (Categories) (available for California residents only):  We verify your Request to Know Categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you.  If we cannot do so, we will refer you to this Notice for a general description of our data practices. 
• Right to Know (Specific Pieces):  We verify your Request To Know Specific Pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying you together with a signed declaration under penalty of perjury that you are the Consumer whose PI is the subject of the request. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat it as a Right to Know Categories Request if you are a California resident. 
• Right to Delete:  We verify your Request to Delete to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized deletion.
• Correction:  We verify your Request to Correct PI to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized correction.
  To protect Consumers, if we are unable to verify you sufficiently we will be unable to honor your request. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

(2) Agent Requests

You may use an authorized agent to make a request for you, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you.  You can learn how to do this by visiting the agent section of our U.S. Data Subject Action Request Form. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable U.S. Privacy Laws.

(3) Appeals

You may appeal the Firm’s decision regarding a request by following the instructions included in our response to you. 

(h) Our Responses

Some PI that we maintain is insufficiently specific for us to be able to associate it with a Consumer (e.g., clickstream data tied only to a pseudonymous browser ID). We do not include that PI in response to those requests.  If we deny a request, in whole or in part, we will explain the reasons in our response.  

We will make commercially reasonable efforts to identify Consumer PI that we Process to respond to your Consumer request(s).  In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest.  We reserve the right to direct you to where you may access and copy responsive PI yourself.  We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome.  If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision.  You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with applicable U.S. Privacy Laws and our interest in the security of your PI, we will not deliver to you your Social Security number, driver’s license number, or other government-issued ID number in response to a Consumer privacy rights request.

Return to navigation

3. NON-DISCRIMINATION/NO RETALIATION

We will not discriminate or retaliate against you in a manner prohibited by applicable U.S. Privacy Laws for your exercise of your Consumer privacy rights.

Return to navigation

4. NOTICE OF FINANCIAL INCENTIVE PROGRAMS

We do not offer programs requiring you to limit any of your Consumer rights, or otherwise require you to limit your Consumer rights in connection with charging a different price or rate, or offering a different level or quality of good or service, or that would otherwise be considered a financial incentive related to the collection of PI.

Return to navigation

5. OUR RIGHTS AND THE RIGHTS OF OTHERS

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your rights under U.S. Privacy Laws. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.

Return to navigation

6. ADDITIONAL NOTICE FOR CALIFORNIA RESIDENTS

In addition to the CCPA, certain Californians are entitled to certain other notices, as follows:

This Notice provides information on our online practices and your California rights specific to our online services. Without limitation, Californians that visit our online services and seek to acquire goods, services, money or credit for personal, family or household purposes (e.g., seeking legal counsel in their personal capacity) are entitled to the following notices of their rights:

(a) Shine the Light

We do not disclose “personal information” subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for the third parties’ direct marketing purposes absent your consent.  If you are a California resident, you may request information about our compliance with the Shine the Light law by contacting us at the address set forth in the next section.  Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code.  Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address.

Return to navigation

7. CONTACT US

For general questions about this Notice, you may contact us as follows:

Office of General Counsel - Privacy
Squire Patton Boggs
1000 Key Tower 127 Public Square
Cleveland, OH 44114