After the Supreme Cоurt's decisiоn in Vаn Buren, it is cleаr thаt individuals оnly "exceed authorized access" if they overcome technological "code-based" limitations on access, not ones enforced only by contract or policy.
Shоrt Rib Cоntinued . . . Jаmes is the Chief Privаcy Officer fоr Spаre Rib Sports Logistics, Inc (SRSL). SRSL has about $30 Million in gross revenue per year and does business in California. However, SRSL is not a consumer facing company. Instead, it deals with businesses and sports teams and helps with behind the scenes logistics issues—sometimes, this involves establishing and maintaining rosters or compiling other information from individual athletes, managers, coaches, and occasionally fans. Since SRSL isn’t “consumer facing,” James advises the SRSL CEO that the California Consumer Privacy Act (CCPA) doesn't apply to their company. Karen, a California resident, is an enthusiast of the minor league hockey team, the San Diego Gulls. She has never missed a home game and she frequently enters into raffles for various prizes such as a prize she recently won, dinner with Gulls star, Vinni Lettieri. Raffle participants must list personal information including addresses and phone numbers. SRSL has contracted with the San Diego Gulls to compile and maintain information on all fans who enter into the raffles so that the San Diego Gulls can send customers advertising materials and also track their most avid fans who enter into multiple raffles. In chatting with Vinni over dinner, Karen learns that the Gulls use SRSL for all their logistics needs. Curious, Karen visits the SRSL website. While there, she notices that they don’t have any contact information for consumers wishing to exercise their CCPA rights. Karen starts wondering whether SRSL has any of her data, since she’s been to so many San Diego Gulls games. Accordingly, Karen sends a valid CCPA request to SRSL asking for a copy of her data. James recommends the company ignore Karen’s request because the CCPA doesn't apply to SRSL. QUESTION: In addition to the CCPA, James has also advised the CEO that SRSL does not have to worry about the General Data Protection Regulation (GDPR) as the company is a U.S. Company. When Karen doesn’t get the response she wants from SRSL, she calls her Aunt Gertrude who lives in the European Union (EU) and asks Gertrude to make a GDPR request for Karen’s data. Gertrude send a letter demanding that SRSL release Karen’s data under the GDPR. James responds to Gertrude’s request stating that SRSL is not an EU company and so the GDPR does not apply. Is James correct?