On September 14, 2023, the California State Senate concurred with the amendments introduced by the California State Assembly to Senate Bill 362 for an act relating to data brokers.
The bill would require the California Privacy Protection Agency (“CPPA”) to establish an accessible deletion mechanism by January 1, 2026. This mechanism, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker deletes any personal information related to that consumer held by the data broker or associated service provider or contractor. For this purpose, the bill would require a data broker to register with, pay a registration fee, and provide information to the CPPA, instead of the California Attorney General.
Moreover, the bill would specify requirements for the accessible deletion mechanism in question, and starting from August 1, 2026, would require a data broker to access the mechanism at least once every 31 days and, among other things, process all deletion requests, except as specified. Following the specified date, after a consumer has submitted a deletion request and a data broker has deleted the consumer’s personal information, a data broker would need to delete all personal information of the consumer at least once every 31 days and would be prevented from selling or sharing new consumer’s personal information, unless the consumer requests otherwise.
Under the bill, a data broker that fails to comply with the requirements pertaining to the accessible deletion mechanism described above is liable for civil penalties, administrative fines, fees, and costs, and would raise the amount of the existing civil penalty provisions.
This new requirement will have an impact on data brokers, as well as costs such as the maintenance and monitoring of the future deletion mechanism.
This document is intended to provide only a general background regarding this matter. This document should not be regarded as setting out binding legal advice but rather as a practical overview that is based on our understanding. APM & Co. is not licensed to practice law outside of Israel.
APM Technology and Regulation Team.
