In a groundbreaking move, California Governor Gavin Newsom has signed the Delete Act (SB 362), a bill that empowers Californians with the right to reclaim their personal data from data brokers. This legislation, the first of its kind in the US, not only expands the existing right under state law to have personal data deleted but also streamlines the process, ensuring a single request reaches all brokers.
The Scope and Limitations
While the Delete Act is a significant step forward, it primarily covers data brokers operating within California. These brokers are mandated to register with the California Privacy Protection Agency (CPPA). This registry will be instrumental in facilitating residents’ data requests. However, the law has already faced opposition from several major companies, arguing potential harm to their industry.
The Broader Context: CCPA and CPRA
The California Consumer Privacy Act (CCPA), now under the revised terms of the California Privacy Rights Act (CPRA), had provisions allowing Californians to request individual companies to delete their stored personal data. However, these requests were previously filed individually. The new legislation amplifies this right, offering a consolidated approach, a feature not available elsewhere in the US.
The Implications for Data Brokers
Data brokers, already mandated to register annually with the Office of the Attorney General and pay a $400 fee, are now under increased scrutiny. With approximately 800 brokers operating in California as of 2023, the new terms might not be universally applicable. These companies, through advertising trade groups, have lobbied against the legislation, citing potential harm to consumers and small businesses.
The Road Ahead
Despite the bill’s introduction in April this year, data brokers have until 2026 to comply with the new terms, with full restrictions kicking in by 2028. The bill’s criteria also set specific benchmarks for applicability, including processing personal data of at least 100,000 entities annually and a minimum revenue of $25 million the previous year.
Global Context and Future Predictions
Data brokers, with minimal national-level regulations, have been able to create comprehensive profiles, sometimes even including sensitive health and location data. While California’s new bill offers robust protection, comparable federal legislation is yet to emerge. Some experts predict a potential contraction in the personal data market, with larger companies absorbing smaller entities struggling with costs.
Conclusion
California’s Delete Act (SB 362) is a testament to the state’s commitment to safeguarding its residents’ data privacy rights. While the legislation is a significant stride, its long-term implications, especially concerning federal regulations and the broader data broker industry, remain to be seen.
