Contract analysis

I. Executive Summary This memorandum analyzes how the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code §§ 1798.100–1798.199.100, as amended by the California Privacy Rights Act ("CPRA"), applies to Quorum Insurance Holdings Corp.'s ("Quorum" or "QIH") planned creation and potential third-party commercialization of Derived Data constructed from consumer credit information licensed from Meridian Credit intellig

II. Scope of This Memorandum This memorandum is limited in scope to the application of the CCPA, as amended by the CPRA, to Quorum's planned creation, internal use, and external commercialization of Derived Data constructed from licensed Meridian data products. It does not constitute a comprehensive regulatory compliance assessment for the proposed Quorum-Meridian transaction, which implicates a broader set of federa

III. Background: The Proposed Transaction and Derived Data A. Licensed Data Products Under the proposed MDLA, Meridian will license to Quorum the following three data products: MCI Consumer Credit File™. This product consists of full-file consumer tradeline data covering approximately 310 million consumer records maintained in Meridian's proprietary consumer credit database. The data includes comprehensive tradeline-

IV. CCPA/CPRA Applicability to Quorum A. "Business" Status The CCPA applies to a "business," defined under California Civil Code § 1798.140(d) as a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information (or on behalf

V. Analysis: Derived Data Under CCPA/CPRA A. Is Derived Data "Personal Information"? The threshold question for Quorum's CCPA/CPRA compliance planning is whether the Derived Data that Quorum proposes to create and commercialize constitutes "personal information" within the meaning of the statute. The answer depends on the nature and structure of the specific Derived Data output at issue. As discussed below, Derived D

1. The Spectrum from Raw Data to Fully De-Identified Data It is useful to conceptualize Derived Data along a continuum of identifiability: Raw Meridian Data. At one end of the spectrum sits the raw, unprocessed Meridian consumer credit data — individual consumer credit files containing names, Social Security numbers, addresses, tradeline details, and payment histories. This data is unambiguously "personal information

2. The "Relates To" and "Reasonably Capable of Being Associated With" Standards The CCPA's definition of "personal information" is one of the broadest in any United States privacy statute. Information qualifies as personal information if it "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

3. Implications for QuorumScore™ and Other Derived Products Applying the foregoing standards to Quorum's planned Derived Data products: QuorumScore™ — Per-Consumer Version. If QuorumScore™ is generated on a per-consumer basis and the score is associated with an identified or identifiable individual (whether through direct identifiers, internal consumer ID keys, or linkable quasi-identifiers), the score constitutes pe

1. Definition of "Sale" Under CCPA/CPRA The CCPA defines "sale" in expansive terms. A "sale" means "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration." Cal. Civ. Code § 1798.140(ad)(1). The

2. Definition of "Sharing" Under CPRA The CPRA introduced "sharing" as a concept distinct from "sale." "Sharing" is defined as "sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not

3. Right to Opt Out of Sale/Sharing The CCPA grants consumers the right to opt out of the sale or sharing of their personal information. Cal. Civ. Code § 1798.120(a) ("A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information."). A business that sells or shares personal infor

1. Meridian's Status Vis-à-Vis Quorum The CCPA and CPRA distinguish among three categories of entities that may receive personal information from a business: "service providers," "contractors," and "third parties." The classification determines whether the disclosure of personal information constitutes a "sale" subject to consumer opt-out rights. A "service provider" is an entity that processes personal information o

2. Quorum's Status When Commercializing Derived Data to Third Parties When Quorum licenses Derived Data to third-party businesses, Quorum acts as a "business" disclosing personal information (assuming the Derived Data contains personal information) to "third parties" as defined under CCPA § 1798.140(ai). The third-party licensees of QuorumScore™ and related products — whether they are insurance carriers, reinsurers,

3. Data Processing Agreement Considerations A Draft Data Processing Agreement ("DPA") is being prepared separately for the MDLA to address Meridian's obligations to Quorum as the provider of consumer data. That DPA addresses, inter alia, Meridian's representations regarding lawful collection of the data, Meridian's obligations to maintain appropriate security safeguards, and Meridian's cooperation with consumer right

VI. De-Identification as the Key Compliance Pathway A. CCPA De-Identification Standard The CCPA provides that "deidentified" information is excluded from the definition of "personal information" and is therefore not subject to CCPA obligations. Cal. Civ. Code § 1798.140(m). The statute defines "deidentified" as information that "cannot reasonably be used to infer information about, or otherwise be linked to, a partic

1. Technical safeguards. The business has implemented technical safeguards that prohibit reidentification of the consumer to whom the information may pertain.

2. Business processes — prohibiting reidentification. The business has implemented business processes that specifically prohibit reidentification of the information.

3. Business processes — preventing inadvertent release. The business has implemented business processes to prevent inadvertent release of deidentified information.

4. No attempt to reidentify. The business makes no attempt to reidentify the information. Cal. Civ. Code § 1798.140(m)(1)–(4). If Quorum can satisfy these four requirements with respect to specific Derived Data products, those products fall outside the definition of "personal information" and may be freely commercialized to third parties without triggering opt-out rights, access rights, deletion rights, or any other