Under the CCPA, a defendant can be both a “business” and a “service provider.”

A South Carolina District Court Judge denied Blackbaud’s Motion to Dismiss a claim for violation of the California Consumer Privacy Act.  In re Blackbaud_ Inc._ 2021 U.S. Dist. LEXIS 151831 (August 12, 2021).

Here, California Plaintiffs adequately allege that Blackbaud qualifies as a “business” under the CCPA. First, they specifically maintain that “Blackbaud and its direct customers determine the purposes and means of processing consumers’ personal information. Blackbaud uses consumers’ personal data to provide services at customers’ requests, as well as to develop, improve, and test Blackbaud’s services.” (ECF No. 77 at 215 ¶ 823.) The CCAC is also filled with claims that Blackbaud develops software solutions to process its customers’ patrons’ personal information. (See, e.g., id. at 7 ¶ 15 (“Blackbaud markets itself to Social Good Entities by developing data-hosting ‘solutions’ to meet those entities’ needs”); 115 ¶ 433 (“Blackbaud determines the purposes or means of processing customers’ data based on which solutions or services are utilized by the customers”); 116 ¶ 436 (Blackbaud offers “professional and managed services in which its expert consultants provide data conversion, implementation, and customization services for each of its software solutions”).) Second, the California Plaintiffs contend that Blackbaud has “annual gross revenues over $25 million.” (Id. at 214 ¶ 821.)

Blackbaud’s status as a “business” under the CCPA is further supported by Blackbaud’s alleged registration as a “data broker” in California. [*13] California Plaintiffs claim that Blackbaud is registered as a “data broker” in California pursuant to Cal. Civ. Code § 1798.99.80. (Id. at 215 ¶ 824.) Cal. Civ. Code § 1798.99.80 provides that a “data broker” is a “business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Cal. Civ. Code § 1798.99.80(d) (West 2021) (emphasis added). The provision also explicitly employs the same definition of “business” as the CCPA, Cal. Civ. Code § 1798.140(c). Cal. Civ. Code § 1798.99.80(a) (West 2021) (“(a) ‘Business’ has the meaning provided in subdivision (c) of Section 1798.140.”). Since an entity must qualify as a “business” under the CCPA in order to be registered as a “data broker” in California, Blackbaud’s alleged registration as a “data broker” suggests that it is also a “business” under the CCPA.

Id. *11-13.

Evaluating Blackbaud’s claim that it is a service provider rather than a business, the Court found that “[b]ecause Blackbaud could be both a “service provider” and a “business” under the CCPA, it would not be insulated from liability under the CCPA if it qualified as a “service provider.  Consequently, the court need not consider whether Blackbaud is a “service provider” under the CCPA to resolve the Motion to Dismiss presently before the court.”  Id. *15.