PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT — PREPARED IN ANTICIPATION OF LITIGATION AND FOR THE PURPOSE OF PROVIDING LEGAL ADVICE
CALDERWOOD & HARKNESS LLP Data Privacy & Cybersecurity Practice Group
MEMORANDUM
March 17, 2023
TO: Carolyn Whitford, General Counsel & Executive Vice President, Quorum Insurance Holdings Corp. Gregory Stahl, Vice President, Legal Affairs, Quorum Insurance Holdings Corp.
FROM: Lisa Johannsen, Associate, Data Privacy & Cybersecurity, Calderwood & Harkness LLP
REVIEWED BY: David Cartwright, Partner, Data Privacy & Cybersecurity, Calderwood & Harkness LLP
RE: CCPA/CPRA Implications for Creation and Third-Party Commercialization of Derived Data Built from Meridian Credit intelligence, Inc. Consumer Credit Information
MATTER NO.: C&H Matter No. 1025-00008
Right-click to update Table of Contents
I. Executive Summary
This memorandum analyzes how the California Consumer Privacy Act ("CCPA"), Cal. Civ. Code §§ 1798.100–1798.199.100, as amended by the California Privacy Rights Act ("CPRA"), applies to Quorum Insurance Holdings Corp.'s ("Quorum" or "QIH") planned creation and potential third-party commercialization of Derived Data constructed from consumer credit information licensed from Meridian Credit intelligence, Inc. ("Meridian" or "MCI"). This analysis is provided at the request of Quorum's Office of General Counsel in connection with the ongoing negotiation of the Master Data License Agreement ("MDLA") between Quorum and Meridian.
Transaction Context. Quorum (a Delaware corporation, traded on Nasdaq under the ticker symbol QIHC, with its principal offices located at 1200 Atlantic Street, Suite 3400, Stamford, Connecticut 06901) is currently negotiating a five-year, $60,000,000 enterprise data-licensing arrangement with Meridian (a Georgia corporation, headquartered at 3300 Peachtree Road NE, Suite 2100, Atlanta, Georgia 30326). Under the proposed MDLA, Quorum will ingest three of Meridian's core data products: (i) the MCI Consumer Credit File™, comprising approximately 310 million consumer records; (ii) MCI CommercialView™, comprising approximately 42 million business records; and (iii) MCI AltSignal™, comprising approximately 85 million consumer alternative-data records encompassing utility, telecom, and rental payment histories.
Derived Data Strategy. Quorum intends to blend the licensed Meridian data with its own substantial first-party data assets — including claims histories, policy data, and telematics information — to create blended risk scores, propensity models, and enriched datasets. These outputs are collectively referred to herein as "Derived Data." Central to Quorum's Derived Data strategy is the proprietary QuorumScore™ predictive underwriting model, for which a United States Patent and Trademark Office application is currently pending (Serial No. 97/482,116). Quorum projects $40–50 million in B2B licensing revenue from QuorumScore™ and related Derived Data products by fiscal year 2027. The CCPA/CPRA compliance posture of these outputs directly and materially affects the viability of that revenue line.
Key Conclusions. As set forth in greater detail below, CCPA/CPRA create significant constraints on Quorum's ability to commercialize Derived Data to third parties unless rigorous de-identification standards are met. Specifically:
•  Derived Data that retains a linkage to individual consumers — including per-consumer QuorumScore™ ratings — constitutes "personal information" under the CCPA's expansive definition and, if licensed to third parties for monetary consideration, constitutes a "sale" of personal information triggering opt-out rights, consumer access and deletion rights, and other compliance obligations.
•  De-identification under CCPA § 1798.140(m) provides the most effective compliance pathway for enabling external commercialization of Derived Data. If Derived Data is properly de-identified — through a combination of aggregation, removal of direct and quasi-identifiers, and implementation of technical and administrative safeguards against re-identification — it falls outside the scope of "personal information" and may be freely commercialized without triggering CCPA obligations.
•  The CCPA de-identification standard provides a legally grounded, objective framework that can serve as the basis for resolving the ongoing "sufficient transformation" dispute with Meridian in the Article VII negotiations of the MDLA, replacing Meridian's proposed subjective standard (under which Meridian would retain sole discretion to determine whether Derived Data has been "sufficiently transformed") with an externally validated legal benchmark.
This memorandum recommends specific contractual provisions for the MDLA, operational safeguards for Quorum's data engineering and data science teams, and a product-design framework that segregates per-consumer Derived Data outputs (for internal underwriting use, where FCRA permissible purposes may apply) from aggregate, de-identified outputs (for external B2B commercialization).
II. Scope of This Memorandum
This memorandum is limited in scope to the application of the CCPA, as amended by the CPRA, to Quorum's planned creation, internal use, and external commercialization of Derived Data constructed from licensed Meridian data products. It does not constitute a comprehensive regulatory compliance assessment for the proposed Quorum-Meridian transaction, which implicates a broader set of federal and state regulatory frameworks.
Companion Analyses. Separate memoranda are being prepared concurrently by members of the Calderwood & Harkness deal team addressing the following topics:
•  FCRA Permissible Purpose Analysis: David Cartwright, Partner, is preparing a comprehensive memorandum analyzing the Fair Credit Reporting Act ("FCRA") permissible purpose requirements applicable to Quorum's receipt and use of Meridian consumer credit data for insurance underwriting, claims-fraud detection, and related purposes. That memorandum will address, among other things, whether Quorum's creation of Derived Data from Meridian consumer report data constitutes the creation of a new "consumer report" subject to independent FCRA obligations. A separately drafted FCRA Permissible Purpose Certification schedule for the MDLA is also being prepared by the undersigned.
•  GLBA and State Insurance Data-Security Regulations: David Cartwright is also preparing a memorandum addressing Gramm-Leach-Bliley Act ("GLBA") safeguards requirements and state insurance data-security regulations, including New York Department of Financial Services Cybersecurity Requirements for Financial Services Companies, 23 N.Y.C.R.R. Part 500, as they apply to Quorum's receipt, storage, and processing of Meridian data.
•  intellectual Property Ownership of Derived Data: Wendy Schultz and Omar Siddiqui, of Calderwood & Harkness's intellectual Property Transactions practice group, are preparing an analysis of the IP ownership questions raised by the Derived Data dispute in the MDLA negotiations, including copyright and trade-secret issues associated with blended data products derived from a combination of Meridian-licensed data and Quorum first-party data. Ms. Schultz circulated a critique memorandum in May 2023 addressing Meridian's "sufficient transformation" proposal, which is referenced herein.
Data Products Addressed. This memorandum focuses on the consumer-facing data products within the Meridian license: the MCI Consumer Credit File™ and MCI AltSignal™. These products contain information about individual consumers and therefore raise the most significant CCPA/CPRA compliance concerns. MCI CommercialView™ (commercial entity credit data on approximately 42 million businesses) presents fewer CCPA issues because information about business entities generally falls outside the scope of "personal information" under the CCPA. However, as discussed briefly in Part V below, MCI CommercialView™ data relating to sole proprietorships or individually identifiable business owners may constitute personal information, and that subset of data should be addressed in Quorum's compliance planning.
Governing Law. The MDLA is anticipated to be governed by New York law. However, CCPA/CPRA compliance obligations are not a matter of choice of law; they attach as a function of Quorum's status as a "business" under the CCPA and its collection and processing of personal information of California residents. Given that a significant portion of the approximately 310 million consumer records in the MCI Consumer Credit File are attributable to California residents — California's population represents approximately 11.7% of the total United States population, suggesting roughly 36 million California consumer records within the dataset — the CCPA/CPRA obligations analyzed herein apply regardless of the contractual governing-law provision in the MDLA.
III. Background: The Proposed Transaction and Derived Data
A. Licensed Data Products
Under the proposed MDLA, Meridian will license to Quorum the following three data products:
MCI Consumer Credit File™. This product consists of full-file consumer tradeline data covering approximately 310 million consumer records maintained in Meridian's proprietary consumer credit database. The data includes comprehensive tradeline-level detail: account identifiers, creditor names, account types, dates of account opening and closure, credit limits, outstanding balances, payment histories, delinquency indicators, public record information (including bankruptcies, tax liens, and civil judgments), and collection items. The MCI Consumer Credit File also includes consumer identifying information, including full legal names, current and prior addresses, Social Security numbers, dates of birth, and employment information. Data will be refreshed via daily batch delivery (SFTP) and real-time query access (REST API), ensuring that Quorum's underwriting systems operate on current credit data.
MCI AltSignal™. This product consists of alternative consumer data covering approximately 85 million consumer records. The data captures non-traditional payment obligations and financial behaviors, including utility payment histories (electric, gas, water), telecom payment records (landline, mobile, internet service), and residential rental payment data. MCI AltSignal™ is designed to extend credit visibility to "thin-file" and "no-file" consumers who may lack sufficient traditional credit history for conventional scoring. Data will be refreshed daily via SFTP batch delivery. Consumer identifying information is included to facilitate matching and linkage with the MCI Consumer Credit File and with Quorum's own first-party data.
MCI CommercialView™. This product consists of commercial credit data on approximately 42 million businesses. It includes business identification data (legal name, trade name, EIN, address, SIC/NAICS codes), commercial tradeline information, UCC filings, liens, judgments, and business credit scores. Data is refreshed weekly via SFTP batch delivery. While primarily a commercial data product, MCI CommercialView™ includes records for sole proprietorships and small businesses where the business identity is effectively inseparable from the individual owner's identity — a subset that implicates CCPA protections.
Volume and Pricing. The total estimated monthly data volume across all three products is approximately 437 million records, which falls within the 500 million records-per-month base tier negotiated in the MDLA pricing schedule. Records in excess of the base tier are subject to an overage rate of $0.003 per record. The five-year aggregate license fee of $60,000,000 reflects annual payments of $12,000,000, subject to annual CPI adjustment beginning in Year 2 of the license term.
B. Quorum's Intended Uses of Licensed Data
Quorum intends to use the licensed Meridian data products across four principal categories of business activity:
Enhancement of Automated Underwriting. Quorum will integrate Meridian consumer credit data and alternative data into its automated underwriting platforms across its property-and-casualty, life, and specialty insurance lines of business. This integration is intended to improve risk selection, pricing accuracy, and speed of policy issuance. The internal consumption of Meridian data for underwriting purposes represents Quorum's primary business justification for the MDLA and, as discussed in Part IV.C below, may fall within the scope of the CCPA's GLBA exemption and the FCRA preemption provision.
Claims-Fraud Detection. Quorum will incorporate Meridian data into its claims-fraud detection algorithms, using credit-behavior patterns and financial anomalies to flag potentially fraudulent claims for further investigation. These algorithms operate across Quorum's entire book of business and are managed by Quorum's Special Investigations Unit in coordination with its data science team.
Customer Propensity Scoring. Quorum will use Meridian data to develop customer propensity scores for cross-sell and upsell campaigns, lapse-risk prediction, and customer lifetime value modeling. These applications are oriented toward Quorum's existing policyholder base and are primarily internal marketing and retention tools.
Creation of Derived Data. This is the activity most directly at issue in this memorandum. Quorum intends to blend the licensed Meridian data with its own first-party data assets — including detailed claims history, granular policy-level data, and telematics data collected from connected-vehicle and IoT devices — to create a suite of blended risk scores, propensity models, and enriched datasets. These outputs are collectively referred to as "Derived Data." The centerpiece of the Derived Data strategy is QuorumScore™, a proprietary predictive underwriting model that generates composite risk scores by combining Meridian credit signals with Quorum's insurance-experience data. Quorum has filed a United States patent application for the QuorumScore™ methodology (USPTO Serial No. 97/482,116), and the model is considered a core strategic asset by Quorum's executive leadership.
Quorum projects that QuorumScore™ and related Derived Data products will generate $40–50 million in annual B2B licensing revenue by fiscal year 2027. Potential licensees include other insurance carriers, reinsurers, managing general agents, insurance-linked securities investors, and financial-services firms. The viability of this revenue projection is directly contingent on Quorum's ability to commercialize Derived Data to third parties in compliance with applicable data-privacy regulations — most critically, the CCPA/CPRA.
C. The Derived Data Dispute in the MDLA Negotiations
The treatment of Derived Data is the most actively contested issue in the MDLA negotiations and has been the subject of extensive exchanges between the parties' legal and commercial teams since the fourth quarter of 2022. The dispute centers on three interrelated questions: (i) who owns the intellectual property in Derived Data; (ii) whether Quorum may commercialize Derived Data to third parties; and (iii) if so, under what conditions and at what cost.
Meridian's Position. Meridian contends that Derived Data constitutes a "derivative work" (within the meaning of 17 U.S.C. § 101) that incorporates or is built upon Meridian's proprietary data, and that Meridian therefore retains intellectual property rights in the Derived Data. Meridian demands: (a) a perpetual, royalty-free, fully transferable license-back from Quorum granting Meridian the right to use all Derived Data for any purpose; (b) a prohibition on third-party commercialization of Derived Data unless the outputs have been "sufficiently transformed" such that Meridian's raw data cannot be reverse-engineered from the outputs, with Meridian retaining sole discretion to determine whether "sufficient transformation" has been achieved; and (c) a fifteen percent (15%) revenue share on any Derived Data commercialization that Meridian, in its sole discretion, approves for external licensing.
Quorum's Position. Quorum contends that it owns all intellectual property in Derived Data, that no license-back is appropriate, and that it should have the unrestricted right to use, sublicense, and commercialize Derived Data to third parties without additional fees to or consent from Meridian. Quorum's position is grounded in the argument that the intellectual value of Derived Data lies in Quorum's proprietary algorithms, first-party data, and analytical methodologies — not in the raw Meridian data inputs — and that Meridian is being fully compensated for its data through the $60 million license fee.
Quorum's Revised Compromise Framework. Following internal discussions with Quorum's legal and commercial teams, and informed by the critique memorandum prepared by Wendy Schultz in May 2023, Quorum has developed a revised compromise framework that it intends to present to Meridian in or around June 2023. Under this framework: (a) Quorum retains full ownership of all intellectual property in Derived Data; (b) no license-back is granted to Meridian; (c) Quorum may commercialize Derived Data to third parties provided that the outputs are "sufficiently de-identified and transformed" pursuant to an objective, jointly agreed standard — rather than a standard subject to Meridian's sole discretion; (d) no revenue share is payable to Meridian; and (e) a specific carve-out protects QuorumScore™ as Quorum's proprietary asset.
This memorandum's CCPA/CPRA analysis directly informs the de-identification component of the Derived Data compromise. As discussed in Part VI below, the CCPA's statutory de-identification standard provides a ready-made, externally validated, legally recognized framework that can serve as the objective benchmark for when Derived Data may be freely commercialized to third parties — providing both parties with a standard that is grounded in law rather than in either party's subjective judgment. The contractual provisions needed to implement this framework in Article VII of the MDLA are discussed in Part VIII.
IV. CCPA/CPRA Applicability to Quorum
A. "Business" Status
The CCPA applies to a "business," defined under California Civil Code § 1798.140(d) as a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that collects consumers' personal information (or on behalf of which such information is collected), and that alone or jointly with others determines the purposes and means of the processing of consumers' personal information, and that satisfies one or more of three specified thresholds.
Quorum satisfies the threshold requirements by a wide margin. Quorum is a for-profit Delaware corporation that does business in the State of California. Its fiscal year 2023 financial results — annual gross revenues of $4.18 billion, net income of $312 million, total assets of $27.6 billion, and an approximate market capitalization of $8.9 billion — vastly exceed the CCPA's threshold requirement of $25 million in annual gross revenues. Additionally, by virtue of the Meridian data-licensing arrangement alone, Quorum will annually process personal information of well in excess of 100,000 California consumers, satisfying the alternative statutory threshold as well. Quorum's multi-line insurance operations actively serve California policyholders across its property-and-casualty, life, and specialty lines of business, establishing the requisite nexus with the State of California.
The CPRA amendments, which took effect on January 1, 2023, further expand the obligations applicable to businesses like Quorum. The CPRA created the California Privacy Protection Agency ("CPPA") as a dedicated enforcement body and introduced new categories of "sensitive personal information" that trigger heightened protections and consumer rights. As discussed below, certain elements of the Meridian data products qualify as "sensitive personal information," which has direct implications for Quorum's compliance obligations.
B. "Personal Information" Classification of Meridian Data
The CCPA defines "personal information" as "information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v)(1). The definition is intentionally broad and encompasses a wide range of data categories enumerated in the statute, including but not limited to: real names, aliases, postal addresses, unique personal identifiers, online identifiers, Internet Protocol addresses, email addresses, Social Security numbers, driver's license numbers, passport numbers, financial information (including bank account numbers), commercial information, biometric information, internet browsing history, geolocation data, professional or employment-related information, education information, and inferences drawn from any of the enumerated categories. See Cal. Civ. Code § 1798.140(v)(1)(A)–(K).
Meridian's consumer credit files and alternative-data feeds contain data elements that fall squarely within this definition. The MCI Consumer Credit File™ includes, at a minimum: full legal names, current and prior residential addresses, Social Security numbers, dates of birth, financial account information (creditor names, account numbers, credit limits, balances, and payment histories), and public record information. The MCI AltSignal™ product includes consumer names, addresses, utility account information, telecom account details, and rental payment records. Each of these data elements — individually and in combination — constitutes "personal information" under the CCPA because it identifies, relates to, or could reasonably be linked to a particular consumer.
Certain data elements within the Meridian products may also constitute "sensitive personal information" as defined by CPRA § 1798.140(ae). The CPRA designates the following as sensitive personal information, among other categories: Social Security numbers, driver's license numbers, state identification card numbers, passport numbers, financial account numbers (including log-in credentials or financial account numbers in combination with any required security or access code, password, or credentials allowing access to an account), and precise geolocation data. Social Security numbers and financial account information contained in the MCI Consumer Credit File™ clearly qualify as sensitive personal information under this definition. This classification triggers additional consumer rights under CPRA § 1798.121, including the right to limit the use and disclosure of sensitive personal information to purposes necessary for performing the services or providing the goods reasonably expected by an average consumer. The implications of this heightened classification for Quorum's commercialization plans are discussed in Part VII.D below.
C. Insurance Exemption Analysis
The CCPA contains several exemptions that may be relevant to entities in the insurance and financial-services industries. The most significant for Quorum's purposes is the exemption set forth in CCPA § 1798.145(e), which provides that the CCPA does not apply to personal information "collected, processed, sold, or disclosed pursuant to" the Gramm-Leach-Bliley Act (15 U.S.C. §§ 6801–6809) if the CCPA is in "conflict" with GLBA. This exemption, however, is more limited than it may initially appear.
GLBA Exemption — Internal Use. Quorum's internal use of Meridian data for insurance underwriting, pricing, and claims administration may fall within the scope of activities regulated by GLBA. The GLBA restricts the disclosure of consumers' "nonpublic personal information" by financial institutions (including insurers) but permits such institutions to share information as necessary to "effect, administer, or enforce a transaction requested or authorized by the consumer" or for certain other enumerated purposes. To the extent that Quorum is collecting and processing Meridian consumer credit data for the purpose of underwriting insurance policies requested by consumers or administering claims under those policies, such activities may be governed by the GLBA and, accordingly, may be exempt from CCPA under § 1798.145(e).
GLBA Exemption — Third-Party Commercialization. However, the GLBA exemption is unlikely to shield Quorum's planned third-party commercialization of Derived Data from CCPA obligations. The commercialization of Derived Data products to unaffiliated third parties — insurers, reinsurers, financial-services firms, and others — for revenue-generating purposes bears no nexus to the consumer-requested transactions (insurance policies and claims) that justify GLBA-exempt processing. The external licensing of QuorumScore™ and related products is a standalone commercial enterprise that serves Quorum's own revenue objectives, not the effectuation or administration of any consumer-requested insurance transaction. Accordingly, we conclude that the GLBA exemption under CCPA § 1798.145(e) does not extend to this category of activity.
State-Level Insurance Exemptions. The Insurance Information and Privacy Protection Act ("IIPPA"), adopted in various forms by multiple states, imposes its own requirements on the collection, use, and disclosure of personal information by insurance institutions, agents, and insurance-support organizations. While certain states' IIPPA-based statutes may provide parallel protections that limit the reach of the CCPA in insurance-specific contexts, the IIPPA does not preempt the CCPA for non-insurance commercial activities such as third-party data licensing. The California Insurance Information and Privacy Protection Act (Cal. Ins. Code §§ 791–791.26) applies to insurance-related transactions and does not create an exemption from the CCPA for commercial data-licensing activities that fall outside the scope of the insurance relationship.
Conclusion on Exemptions. The GLBA exemption does not shield Quorum's third-party commercialization of Derived Data from CCPA/CPRA obligations. While Quorum's internal use of Meridian data for insurance underwriting and claims purposes may benefit from the GLBA exemption and, separately, from the FCRA preemption discussed in Part IX, the planned external commercialization of Derived Data products — the activity that generates the projected $40–50 million in B2B revenue — falls squarely within the CCPA/CPRA's regulatory reach.
V. Analysis: Derived Data Under CCPA/CPRA
A. Is Derived Data "Personal Information"?
The threshold question for Quorum's CCPA/CPRA compliance planning is whether the Derived Data that Quorum proposes to create and commercialize constitutes "personal information" within the meaning of the statute. The answer depends on the nature and structure of the specific Derived Data output at issue. As discussed below, Derived Data exists on a spectrum — from raw, individually identifiable data at one end to fully aggregated, de-identified statistical outputs at the other — and its classification under the CCPA varies accordingly.
1. The Spectrum from Raw Data to Fully De-Identified Data
It is useful to conceptualize Derived Data along a continuum of identifiability:
Raw Meridian Data. At one end of the spectrum sits the raw, unprocessed Meridian consumer credit data — individual consumer credit files containing names, Social Security numbers, addresses, tradeline details, and payment histories. This data is unambiguously "personal information" under CCPA § 1798.140(v). No serious argument can be made to the contrary, and Quorum does not contend otherwise.
Per-Consumer Derived Scores. One step along the spectrum are derived outputs that remain tied to individual consumers. For example, a QuorumScore™ rating assigned to an individual policyholder — blending that specific consumer's Meridian credit data with that consumer's Quorum claims history and telematics data — remains "personal information" because it "relates to" and is "reasonably capable of being associated with" that identified consumer. The fact that the score is the output of a proprietary algorithm does not change its character as personal information; it is still a data point about a particular, identifiable person.
Cohort-Level or Segment-Level Outputs. Further along the spectrum are aggregated outputs computed at the level of a consumer cohort or market segment, such as "average QuorumScore™ for female drivers aged 25–34 in the Los Angeles metropolitan statistical area." If such outputs are computed over a sufficiently large cohort and presented in a manner that does not permit identification of any individual consumer within the cohort, they may no longer constitute "personal information." However, care must be taken to ensure that the aggregation is genuine — that the cohort sizes are sufficiently large and the segment definitions sufficiently broad to prevent identification through cross-referencing with external data.
Model Weights and Parameters. At the far end of the spectrum are the internal mathematical parameters of machine-learning models trained on Meridian data — for example, the weights assigned to various input features in a neural network or gradient-boosted decision-tree ensemble. Model weights in themselves do not identify any individual consumer; they represent learned statistical relationships across the training data. Accordingly, model parameters are likely not "personal information" under the CCPA. However, this conclusion is nuanced and evolving. Certain privacy researchers have demonstrated techniques for extracting or inferring information about individual training-data records from model parameters under certain conditions (so-called "model inversion" or "membership inference" attacks). While these risks are primarily theoretical in the context of large-scale models trained on hundreds of millions of records, Quorum's data science team should evaluate the specific risk profile of the QuorumScore™ model architecture to ensure that model parameters do not inadvertently encode individually identifiable information.
2. The "Relates To" and "Reasonably Capable of Being Associated With" Standards
The CCPA's definition of "personal information" is one of the broadest in any United States privacy statute. Information qualifies as personal information if it "identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household." Cal. Civ. Code § 1798.140(v)(1) (emphasis added). Several elements of this definition are particularly relevant to the Derived Data analysis.
The "relates to" standard extends beyond information that directly identifies a consumer (e.g., a name or Social Security number) to encompass information that pertains to or concerns a consumer in some meaningful way. A QuorumScore™ assigned to an individual consumer "relates to" that consumer because it is a characterization of that consumer's risk profile. Even if the score were communicated without the consumer's name — for example, as "Consumer ID 5847291: QuorumScore 742" — the score would still relate to that specific consumer and would be associated with that consumer through Quorum's internal data systems.
The "reasonably capable of being associated with" standard introduces a reasonableness test. Information that has been stripped of direct identifiers but that could, with reasonable effort, be re-associated with a specific consumer through cross-referencing, data matching, or other analytical techniques remains personal information. This standard is particularly important for quasi-identified data — data from which names and Social Security numbers have been removed but which retains combinations of attributes (such as date of birth, ZIP code, gender, and credit characteristics) that could be used to identify individuals through linkage with external datasets. Research by Latanya Sweeney and others has demonstrated that as few as three quasi-identifiers (ZIP code, date of birth, and gender) can uniquely identify a substantial majority of the United States population.
The "could reasonably be linked, directly or indirectly" standard further broadens the scope to encompass indirect linkages. Even if Quorum's Derived Data does not contain any direct identifier, if the data could reasonably be linked to a consumer through an intermediary dataset, linkage key, or re-identification technique, it remains personal information. This is a factual determination that depends on the specific data elements retained in the Derived Data, the availability of external linking datasets, and the state of re-identification technology.
3. Implications for QuorumScore™ and Other Derived Products
Applying the foregoing standards to Quorum's planned Derived Data products:
QuorumScore™ — Per-Consumer Version. If QuorumScore™ is generated on a per-consumer basis and the score is associated with an identified or identifiable individual (whether through direct identifiers, internal consumer ID keys, or linkable quasi-identifiers), the score constitutes personal information about that consumer. This is true regardless of the sophistication of the algorithm that produces the score or the fact that Quorum's proprietary methodology is embedded in the computation. The commercial implication is significant: a per-consumer QuorumScore™ product, if sold to third parties, would constitute a "sale" of personal information under the CCPA, triggering the full suite of consumer rights and business obligations discussed in Parts V.B and VII below.
QuorumScore™ — Aggregate Version. If QuorumScore™ is restructured for external commercialization as an aggregate statistical product — for example, risk-band distributions, segment-level benchmarks, or industry-wide trend analytics that do not identify or relate to any individual consumer — such outputs may fall outside the definition of personal information, provided they meet the CCPA de-identification requirements discussed in Part VI. This product-design distinction is critical to Quorum's ability to pursue its projected B2B licensing revenue while maintaining CCPA compliance.
Enriched Consumer Profiles. If Quorum creates enriched consumer profiles that combine Meridian credit data with Quorum first-party data (e.g., a consumer record that includes credit score, claims history, telematics risk indicators, and QuorumScore™), those profiles are unambiguously personal information — indeed, they represent a more comprehensive personal information record than any single source dataset would provide standing alone. These products cannot be commercially licensed to third parties without triggering the CCPA's "sale" provisions.
Model Coefficients and Training Artifacts. As noted above, model parameters, coefficients, feature-importance rankings, and similar training artifacts are likely not personal information in themselves, subject to evaluation of model-inversion risks specific to the QuorumScore™ architecture. If Quorum were to license its model architecture (as opposed to consumer-level outputs), such licensing would present fewer CCPA concerns — though it would raise separate intellectual property and trade-secret issues addressed in the companion IP memorandum.
Practical Guidance. The manner in which Derived Data is structured for external commercialization determines its CCPA classification. The same underlying analytical capability — the QuorumScore™ predictive model — can produce outputs that either are or are not personal information depending on whether the outputs are delivered at the individual consumer level or at an aggregate level. This observation is central to the recommendations in Part XI of this memorandum.
B. "Sale" and "Sharing" of Personal Information
1. Definition of "Sale" Under CCPA/CPRA
The CCPA defines "sale" in expansive terms. A "sale" means "selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration." Cal. Civ. Code § 1798.140(ad)(1). The CPRA amended this definition to clarify that the term "sale" does not include the disclosure of personal information to a service provider or contractor who processes the information on the business's behalf pursuant to a written contract that complies with specified requirements. Cal. Civ. Code § 1798.140(ad)(2).
If Quorum licenses Derived Data that constitutes personal information — such as per-consumer QuorumScore™ ratings or enriched consumer profiles — to third-party businesses for monetary consideration, this transaction squarely satisfies the statutory definition of a "sale." Quorum would be "disclosing" and "transferring" personal information to a "third party" in exchange for "monetary consideration" in the form of licensing fees. The projected $40–50 million in B2B revenue from QuorumScore™ and related products constitutes precisely the type of valuable consideration that the statute contemplates.
The consequences of a "sale" determination are significant. Once a disclosure of personal information is classified as a sale, the full panoply of CCPA consumer rights and business obligations is triggered, including the consumer's right to opt out of the sale (discussed immediately below), the business's obligation to provide notice of the sale at or before the point of collection, and the business's obligation to disclose the categories of personal information sold in the preceding twelve months.
2. Definition of "Sharing" Under CPRA
The CPRA introduced "sharing" as a concept distinct from "sale." "Sharing" is defined as "sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration." Cal. Civ. Code § 1798.140(ah)(1). The critical distinction is that "sharing" does not require monetary or other valuable consideration — it is triggered by the purpose of the disclosure (cross-context behavioral advertising) rather than by the receipt of consideration.
While the "sharing" concept is less directly implicated by Quorum's B2B licensing model — Quorum is contemplating licensing Derived Data for risk-assessment and analytical purposes, not for behavioral advertising — this provision could become relevant if any of Quorum's third-party licensees use Derived Data for purposes that include targeted advertising, consumer marketing, or cross-context behavioral profiling. To mitigate this risk, Quorum's downstream licensing agreements should include contractual restrictions on the licensee's use of Derived Data for cross-context behavioral advertising purposes.
3. Right to Opt Out of Sale/Sharing
The CCPA grants consumers the right to opt out of the sale or sharing of their personal information. Cal. Civ. Code § 1798.120(a) ("A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer's personal information."). A business that sells or shares personal information must provide a "Do Not Sell or Share My Personal Information" link on its website and must honor opt-out requests within fifteen (15) business days.
If Quorum's Derived Data constitutes personal information and its third-party licensing constitutes a sale, Quorum must honor opt-out requests from consumers whose data is incorporated in the Derived Data. This creates a potentially formidable operational challenge. With approximately 310 million consumer records in the MCI Consumer Credit File and approximately 85 million records in MCI AltSignal, the universe of consumers who could exercise opt-out rights is vast. More importantly, implementing opt-out at the individual consumer level for Derived Data outputs requires Quorum to maintain granular tracking of which consumers' data was used to generate which Derived Data products — a requirement that may be technically complex to implement depending on the architecture of Quorum's data-blending and model-training pipelines.
For example, if a California consumer exercises the right to opt out of the sale of their personal information, Quorum would need to: (a) identify all Derived Data products that incorporate or were generated using that consumer's data; (b) either exclude that consumer's data from those products or cease selling those products in their current form; and (c) ensure that downstream third-party licensees are notified and comply with any applicable restrictions. For individually scored products (e.g., per-consumer QuorumScore™), compliance is conceptually straightforward — do not sell that consumer's score. For aggregate products trained on datasets that include that consumer's data, compliance is far more complex — does the opt-out require retraining the model without that consumer's data? The CCPA regulations and emerging CPPA guidance do not yet provide clear answers to these questions.
We recommend that Quorum's data engineering team, led by Priya Nair, Director of Data Engineering, be consulted on the technical feasibility of implementing opt-out tracking mechanisms at the individual consumer level for each category of Derived Data product. This assessment should inform both the product-design decisions discussed in Part XI and the technical safeguards required for de-identification discussed in Part VI.
C. Service Provider / Contractor Framework
1. Meridian's Status Vis-à-Vis Quorum
The CCPA and CPRA distinguish among three categories of entities that may receive personal information from a business: "service providers," "contractors," and "third parties." The classification determines whether the disclosure of personal information constitutes a "sale" subject to consumer opt-out rights.
A "service provider" is an entity that processes personal information on behalf of a business pursuant to a written contract that, among other things, prohibits the service provider from retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract. Cal. Civ. Code § 1798.140(ag). Similarly, a "contractor" (a new CPRA category) processes personal information on behalf of a business pursuant to a written contract that includes specified restrictions. Cal. Civ. Code § 1798.140(j). Disclosures of personal information to a service provider or contractor that comply with these contractual requirements are not treated as "sales" under the CCPA.
Under the proposed MDLA, Meridian is the licensor of raw data to Quorum. Meridian provides its data products to Quorum for Quorum's own business purposes — Quorum determines how to use, process, and transform the data. Meridian is not processing data on Quorum's behalf in the manner contemplated by the service provider or contractor definitions; rather, Meridian is providing a data product that Quorum independently consumes. Accordingly, the Quorum-Meridian relationship is a business-to-business data transfer, not a business-to-service-provider delegation. The service provider and contractor safe harbors do not apply to exempt Meridian's disclosure of personal information to Quorum from classification as a "sale."
Whether Meridian's disclosure to Quorum constitutes a "sale" by Meridian raises separate questions that are primarily Meridian's compliance responsibility. However, the MDLA should address this issue contractually to ensure that Meridian has appropriate consumer-facing notices and opt-out mechanisms in place for its own disclosures. The Draft Data Processing Agreement being prepared for the MDLA should address Meridian's representations regarding its own CCPA compliance.
2. Quorum's Status When Commercializing Derived Data to Third Parties
When Quorum licenses Derived Data to third-party businesses, Quorum acts as a "business" disclosing personal information (assuming the Derived Data contains personal information) to "third parties" as defined under CCPA § 1798.140(ai). The third-party licensees of QuorumScore™ and related products — whether they are insurance carriers, reinsurers, managing general agents, or financial-services firms — are independent entities that will use the Derived Data for their own independent business purposes. They are not processing the data on Quorum's behalf.
One potential structural approach to avoid the "sale" classification would be to structure third-party licensing arrangements so that the licensee acts as Quorum's "service provider" rather than as an independent data purchaser. Under such a structure, the licensee would contractually agree to process the Derived Data only for purposes specified by Quorum, would be prohibited from retaining or using the data for its own purposes, and would be subject to the other contractual restrictions required for service-provider status under CCPA § 1798.140(ag). However, this approach is likely artificial and would not withstand regulatory scrutiny. If the economic substance of the arrangement is that the licensee is purchasing data for its own independent use — paying licensing fees, incorporating the data into its own underwriting or analytical systems, and deriving independent commercial value from the data — then the service-provider characterization would be a form over substance exercise that the CPPA or a court would likely disregard. We do not recommend this approach.
Similarly, structuring licensees as "contractors" under the CPRA would require contractual restrictions that are inconsistent with the commercial reality of independent data licensing. A contractor must agree not to retain, use, or disclose the personal information for any commercial purpose other than providing the services specified in the contract. If the licensee is purchasing QuorumScore™ data for its own underwriting or risk-assessment purposes, characterizing this as a "service" performed on Quorum's behalf is not supportable.
3. Data Processing Agreement Considerations
A Draft Data Processing Agreement ("DPA") is being prepared separately for the MDLA to address Meridian's obligations to Quorum as the provider of consumer data. That DPA addresses, inter alia, Meridian's representations regarding lawful collection of the data, Meridian's obligations to maintain appropriate security safeguards, and Meridian's cooperation with consumer rights requests received by Quorum. The DPA is an important component of Quorum's CCPA compliance infrastructure for its receipt of Meridian data, but it does not directly address Quorum's downstream commercialization of Derived Data to third parties.
We recommend that a separate downstream DPA template be developed for Quorum's third-party licensing agreements. This downstream DPA should include, at a minimum:
•  A certification by the licensee that it will use the Derived Data only for specified, lawful purposes;
•  A prohibition on the licensee's attempt to re-identify any individual consumer from de-identified Derived Data;
•  Restrictions on further onward transfer or sublicensing of the Derived Data without Quorum's prior written consent;
•  A requirement that the licensee cooperate with consumer rights requests (access, deletion, correction, opt-out) routed through Quorum;
•  Audit rights permitting Quorum to verify the licensee's compliance with the DPA terms; and
•  Indemnification and breach-notification provisions.
These downstream DPA provisions are discussed further in Part VIII.B below.
VI. De-Identification as the Key Compliance Pathway
A. CCPA De-Identification Standard
The CCPA provides that "deidentified" information is excluded from the definition of "personal information" and is therefore not subject to CCPA obligations. Cal. Civ. Code § 1798.140(m). The statute defines "deidentified" as information that "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer," provided that the business maintaining the information satisfies four requirements:
1.  Technical safeguards. The business has implemented technical safeguards that prohibit reidentification of the consumer to whom the information may pertain.
2.  Business processes — prohibiting reidentification. The business has implemented business processes that specifically prohibit reidentification of the information.
3.  Business processes — preventing inadvertent release. The business has implemented business processes to prevent inadvertent release of deidentified information.
4.  No attempt to reidentify. The business makes no attempt to reidentify the information.
Cal. Civ. Code § 1798.140(m)(1)–(4).
If Quorum can satisfy these four requirements with respect to specific Derived Data products, those products fall outside the definition of "personal information" and may be freely commercialized to third parties without triggering opt-out rights, access rights, deletion rights, or any other CCPA consumer rights. The de-identification pathway is thus the key to unlocking Quorum's projected $40–50 million in B2B licensing revenue while maintaining CCPA/CPRA compliance.
This conclusion also aligns with Quorum's negotiating position in the MDLA. The revised compromise framework proposed by Quorum provides that Quorum may commercialize Derived Data to third parties provided the outputs are "sufficiently de-identified and transformed" per an objective, jointly agreed standard. The CCPA de-identification standard under § 1798.140(m) provides precisely the type of objective, externally validated, legally recognized framework that Quorum's compromise envisions.
B. Relationship to Meridian's "Sufficient Transformation" Proposal
As discussed in Part III.C above, Meridian's position in the MDLA negotiations is that Quorum may not commercialize Derived Data externally unless the outputs have been "sufficiently transformed" such that no Meridian raw data can be reverse-engineered from the outputs — with Meridian retaining sole discretion to determine whether "sufficient transformation" has been achieved. Quorum has objected to this standard on multiple grounds, as articulated in Wendy Schultz's May 2023 critique memorandum:
•  Subjectivity. Meridian's standard is inherently subjective because it vests the determination of "sufficient transformation" in Meridian's sole discretion, without any defined criteria, technical benchmarks, or objective testing methodology. This gives Meridian an effective veto over any Quorum commercialization effort, regardless of the rigor of Quorum's de-identification and transformation processes.
•  Commercial uncertainty. The subjective standard creates untenable commercial uncertainty for Quorum's projected revenue line. Quorum cannot commit to third-party licensees, build sales pipelines, or project revenue with any confidence if Meridian can unilaterally determine at any time that a particular Derived Data product has not been "sufficiently transformed."
•  Misalignment of incentives. Meridian has a financial interest in constraining Quorum's external commercialization — because Meridian may wish to develop and sell its own competing data products, or because Meridian may use the "sufficient transformation" veto as leverage to extract the fifteen percent (15%) revenue share it initially demanded. Granting Meridian sole discretion over the transformation standard misaligns incentives and creates a structural conflict of interest.
The CCPA de-identification standard under § 1798.140(m) addresses each of these objections. It provides:
•  Objectivity. The standard is defined by statute and subject to regulatory interpretation by the CPPA — not by either party's unilateral judgment. Both Quorum and Meridian can evaluate compliance against the same fixed, external benchmark.
•  Commercial predictability. If Quorum implements the technical safeguards, business processes, and testing methodologies required by § 1798.140(m), it can determine with reasonable certainty whether specific Derived Data products satisfy the standard — and can proceed with commercialization accordingly.
•  Alignment with legal obligations. Because CCPA compliance is independently required for Quorum's commercialization activities (as demonstrated throughout this memorandum), adopting the CCPA de-identification standard as the MDLA benchmark achieves dual objectives: it satisfies Quorum's regulatory obligations and resolves the contractual dispute with Meridian through a single, unified framework.
We recommend that Quorum propose the CCPA de-identification standard (or a substantially similar formulation) as the benchmark for third-party commercialization eligibility in Article VII of the MDLA, with the following modifications to address Meridian's legitimate concerns:
•  A requirement that Quorum document its de-identification methodology and make that documentation available to Meridian on a confidential basis for review (but not approval);
•  A requirement that Quorum engage a mutually agreed independent third-party expert to conduct periodic de-identification assessments; and
•  A dispute-resolution mechanism (e.g., binding expert determination) if Meridian contests the adequacy of Quorum's de-identification for a specific product.
This framework provides Meridian with transparency and recourse while eliminating Meridian's unilateral veto.
C. Technical Requirements for De-Identification
Satisfying the CCPA de-identification standard requires more than simply removing names and Social Security numbers from Derived Data outputs. The standard requires that the information "cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer" — a functional test that considers the totality of the data elements retained, the availability of external linking datasets, and the feasibility of re-identification techniques. The following technical measures should be evaluated and, as appropriate, implemented by Quorum's data engineering and data science teams:
Aggregation Thresholds. Derived Data products intended for external commercialization should be aggregated at a level that prevents individual identification. This requires establishing minimum cohort sizes (cell sizes) below which data will be suppressed or generalized. The concept of "k-anonymity" — ensuring that every record in a dataset is indistinguishable from at least (k – 1) other records with respect to quasi-identifiers — provides a useful framework. For consumer data of the type at issue, a minimum k-value of 50 to 100 would provide a reasonable baseline, though the appropriate threshold should be calibrated based on a formal re-identification risk assessment specific to each product.
Removal of Direct Identifiers. All direct identifiers — including names, Social Security numbers, account numbers, addresses, dates of birth, telephone numbers, email addresses, and any other unique personal identifiers — must be permanently removed from Derived Data outputs before external commercialization. This step is necessary but not sufficient; removal of direct identifiers alone does not satisfy the de-identification standard if quasi-identifiers or unique attribute combinations remain.
Suppression of Quasi-Identifiers. Quasi-identifiers — data elements that, in combination, can uniquely or nearly uniquely identify an individual — must be suppressed, generalized, or otherwise rendered non-identifying. Common quasi-identifiers in consumer credit data include date of birth (which should be generalized to birth year or age range), ZIP code (which should be truncated to the 3-digit ZIP prefix or replaced with a broader geographic designation), gender, income range, and unique credit-characteristic combinations. The specific quasi-identifiers present in Quorum's Derived Data outputs should be evaluated through a formal linkage-risk analysis.
Differential Privacy Techniques. For machine-learning model outputs — including model weights, coefficients, and feature-importance rankings — differential privacy techniques may be appropriate to provide mathematically rigorous guarantees against re-identification. Differential privacy introduces calibrated statistical noise into model outputs to ensure that no individual training-data record has a disproportionate influence on any model parameter. While the implementation of differential privacy adds computational complexity and may slightly reduce model accuracy, it provides a strong defense against model-inversion and membership-inference attacks. The applicability and practical tradeoffs of differential privacy for QuorumScore™ should be evaluated by Quorum's data science team under the direction of Rajesh Anand, Chief Data Officer, and Diane Lowell, SVP Underwriting Analytics.
Specific Considerations for QuorumScore™. The critical design decision for QuorumScore™ is whether the externally commercialized product generates per-consumer scores or aggregate outputs. If the product generates per-consumer scores — even if direct identifiers are removed — the scores may still be "reasonably capable of being associated with" individual consumers if the licensee possesses complementary data that could enable re-identification. For example, if a third-party insurer licenses per-consumer QuorumScore™ ratings keyed to a hashed consumer identifier, and the insurer independently possesses the unhashed identifier (through its own policyholder data), re-identification is trivial.
By contrast, if QuorumScore™ is commercialized as aggregate risk-band distributions (e.g., "12.4% of consumers in the Southeast auto-insurance segment fall within QuorumScore™ Band 3"), segment-level benchmarks, or model-performance statistics, these outputs are far more likely to qualify as de-identified information. This product-design approach preserves the commercial value of the QuorumScore™ brand and methodology while avoiding the per-consumer identification issue.
Quorum's data engineering team (Priya Nair, Director of Data Engineering), data science team (under Rajesh Anand, Chief Data Officer, and Diane Lowell, SVP Underwriting Analytics), and outside counsel should collaborate to design a formal de-identification protocol that specifies, for each category of Derived Data product, the applicable de-identification techniques, minimum aggregation thresholds, and testing procedures. This protocol should be documented and maintained as a living compliance artifact.
D. Contractual De-Identification Certification
We recommend that both the MDLA and any downstream third-party licensing agreements for Derived Data include a formal certification that Derived Data commercialized externally has been de-identified in accordance with CCPA § 1798.140(m). The certification should include the following elements:
•  A representation by Quorum that the Derived Data has been processed through a documented de-identification protocol;
•  A description of the technical safeguards implemented to prohibit re-identification;
•  A description of the business processes implemented to prohibit re-identification and prevent inadvertent release of identifiable information;
•  An affirmation that Quorum has not attempted and will not attempt to re-identify any consumer from the de-identified Derived Data; and
•  Documentation of