With Tractor Supply, CalPrivacy Showed It Won't Hesitate to Litigate, Say Lawyers
The California Privacy Protection Agency (CalPrivacy) made clear in its Tractor Supply Co. investigation earlier this year that it “will litigate the scope and enforceability of its administrative subpoenas if needed,” ZwillGen’s Yiannis Vandris and two others from the law firm blogged Tuesday. However, legal questions persist about how far back the agency can look for violations, they said.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Tractor Supply agreed to pay $1.35 million in a CalPrivacy settlement Sept. 30 (see 2509300010). The enforcement action came two months after the privacy agency filed a court petition (see 2508060070) alleging that the company, which has more than 2,500 outlets in 49 states, refused to be fully responsive to an investigative subpoena seeking information about its compliance with the California Consumer Privacy Act (CCPA). The agency ended that litigation as part of its resolution with the company.
“The settlement side-stepped a significant jurisdictional question that precipitated [CalPrivacy’s] first-ever court petition to enforce an investigative subpoena under the CCPA,” the ZwillGen lawyers wrote. “Tractor Supply objected to providing information prior to January 1, 2023, arguing that its practices before 2023 fell outside the scope of the [agency’s] enforcement authority because the agency had not yet issued its 2023 regulations and, thus, Tractor Supply lacked actual knowledge of what was prohibited under the CCPA.”
“While the Court ultimately did not have the opportunity to rule on the issue given the parties’ agreement to resolve the underlying allegations -- and another company could make the same argument in the future -- Tractor Supply conceded the argument as part of the settlement, acknowledging that ‘the Agency possesses broad authority to investigate potential violations of the CCPA, including those that occurred before January 1, 2023.’”