Understanding Data Brokers Obligations under California Delete Law (SB-362)

The California Delete Law, also known as Senate Bill 362 (SB-362), is a significant piece of legislation aimed at enhancing consumer privacy rights in the state of California. Signed into law by Governor Gavin Newsom on October 10, 2023, SB-362 amends the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) to provide consumers with greater control over their personal data held by data brokers.

Key Provisions of SB-362

1.     Data Broker Registration: SB-362 requires all data brokers to register annually with the California Privacy Protection Agency (CPPA) instead of the California Department of Justice. Data brokers are businesses that collect and sell personal information about consumers without their direct knowledge.

2.     Accessible Deletion Mechanism: One of the most innovative aspects of SB-362 is the establishment of a one-stop-shop deletion mechanism. By January 1, 2026, the CPPA will create a system that allows consumers to make a single request to delete their personal information from all registered data brokers. This mechanism aims to simplify the process for consumers who previously had to submit individual requests to each data broker.

3.     Prohibition on Selling Data: Data brokers are prohibited from selling or sharing the personal information of consumers who have requested deletion, unless the consumer explicitly consents to such actions. This ensures that consumers' data is not resold or shared without their permission.

4.     Transparency Requirements: The law imposes new disclosure obligations on data brokers, requiring them to provide detailed information about the types of data they collect, including precise geolocation data, reproductive health care data, and personal data about minors. This transparency aims to give consumers a clearer understanding of how their data is being used.

5.     Independent Audits: Data brokers will be subject to independent audits every three years starting January 2028 to ensure compliance with the law's requirements.

Implications for Consumers and Data Brokers

The California Delete Law represents a significant step forward in consumer privacy protection. By simplifying the process of requesting data deletion and imposing stricter regulations on data brokers, the law empowers consumers to take greater control over their personal information. For data brokers, the law introduces new compliance requirements and penalties for non-compliance, ensuring that they handle consumer data responsibly and transparently.

For more details, visit the full text here.