https://www.dwt.com/blogs/privacy--security-law-blog/2019/05/exempt-or-not-exempt-part-2-the-california