Entities

California (31)
Topics and Issues

Data brokers (44)

On April 10, 2024, S.B. 362 was amended to greatly expand the limits on data brokers and allow consumers who seek to hide information to delete information with data brokers. The bill is from Sen. Josh Becker (D-Palo Alto) and the April 10 amendments was issued with a fact sheet. In advance of a scheduled hearing in Senate Judiciary in April 2023, CDIA filed a letter of opposition. The California Chamber of Commerce also filed a letter of opposition.

According to the April 10, summary…

Existing Law:

  • Existing law requires a data broker to register with the Attorney General, pay a registration fee, and provide specified information on or before January 31 following each year in which a business meets the definition of data broker.
  • Existing law defines various terms for these purposes.
  • Existing law establishes the Data Brokers’ Registry Fund and requires that these registration fees be deposited into the fund, to be available for expenditure by the Department of Justice, upon appropriation, for specified purposes.
  • Existing law provides that a data broker that fails to register as required by these provisions is liable for civil penalties, fees, and costs, as specified, and requires these moneys be deposited in the Consumer Privacy Fund with the intent that they be used to fully offset costs incurred in connection with these provisions.
  • Existing law requires the Attorney General to create and maintain an internet website where specified information provided by data brokers is accessible to the public.

The Bill:

  • This bill would incorporate the definitions from the CCPA into the data broker provisions described above.
  • The bill would require a data broker to register with, pay a registration fee to, and provide information to, the agency instead of the Attorney General, and would require the agency to maintain the informational internet website described above.
  • The bill would require a data broker to compile and disclose specified information relating to requests received under the CCPA.
  • The bill would make a data broker that fails to register as required by the provisions described above liable for administrative fines and costs in an administrative action brought by the agency, as specified, and would require the agency to stay an administrative action or investigation upon request by the Attorney General, as specified.
  • The bill would prohibit the Attorney General from filing a civil action pursuant to these provisions if the agency has issued a decision pursuant to these provisions for the same underlying conduct.
  • The bill would prohibit the agency from filing an administrative action pursuant to these provisions if the Attorney General has brought an action pursuant to these provisions for the same underlying conduct.
  • This bill would require the agency to establish an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor.
  • The bill would specify requirements for this accessible deletion mechanism, and would, beginning August 1, 2025, require a data broker to access the mechanism at least once every 31 days and, among other things, process all pending deletion requests, except as specified.
  • The bill would, beginning July 1, 2025, prohibit a data broker from collecting, retaining, selling, or sharing personal information on a consumer who has submitted a deletion request pursuant to these provisions unless the data collection is requested by the consumer.
  • The bill would, beginning January 1, 2027, and every 3 years thereafter, require a data broker to undergo an audit by an independent third party to determine compliance with these provisions, and would require the data broker to submit an audit report to the agency, as specified.
  • The bill would authorize the agency to charge a fee to data brokers for accessing the accessible deletion mechanism, as specified.
  • The bill would provide that a data broker that fails to comply with the requirements pertaining to the accessible deletion mechanism described above is liable for civil penalties, administrative fines, fees, and costs, as specified, and would raise the amount of the existing civil penalty provisions described above.
  • The bill would require that civil penalties, administrative fines, fees, and costs recovered under these provisions be deposited in the Data Brokers’ Registry Fund instead of the Consumer Privacy Fund, and would expand the specified uses of moneys in the Data Brokers’ Registry fund to include the costs incurred by the state courts and the Attorney General in connection with enforcing these provisions and the costs of establishing, maintaining, and providing access to the accessible deletion mechanism described above.
  • The bill would require a data broker to provide additional information to the agency, including information related to requests received under the CCPA, whether the data broker collects specified information, and specified information regarding an audit under the provisions described above.
  • The bill would declare that it furthers the purposes and intent of the CCPA for specified reasons