SB 1104: California Consumer Privacy Act of 2018: data broker registration: accessible deletion mechanism.

Existing law, the California Consumer Privacy Act of 2018 (CCPA), grants to a consumer various rights with respect to personal information that is collected by a business. Existing law generally requires businesses to make certain methods of communication available for consumers to submit personal information requests, including requests for deletion or correction. Existing law requires a business that does not operate exclusively online to make available to consumers at least 2 methods for submitting personal information requests, including, at a minimum, a toll-free telephone number and, if the business maintains an internet website, a website address.

Existing law, the California Privacy Rights Act of 2020 (CPRA), an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

Existing law requires a data broker to register with the agency, and defines data broker to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions.

This bill would define a direct relationship as, among other things, when a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the businesss products or services. The bill would provide that specify circumstances when a data broker does not have a direct relationship relationship, including if it sells personal information outside of a first-party interaction with the consumer. The bill would define a first party as a consumer-facing business with which the consumer intends and expects to interact.

Existing law requires a data broker, in registering with the agency, to provide specified information, including, among other things, whether the data broker collects the personal information of minors or a consumers reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor.

This bill would require a data broker to provide additional information to the agency regarding whether the data broker sells inferences about the attributes of the consumer based on their analysis of specified data, including the personal information of minors and a consumers reproductive health care data.

This bill would require the agency office to establish an online tool a privacy preference tool to enable a consumer to define and store a privacy preference profile regarding data broker data collection and use practices. practices, among other things. The bill would require the tool to, among other things, identify and categorize registered data brokers whose practices are consistent or inconsistent with a consumers privacy preferences based on a data brokers most recent registration disclosures to the agency. evaluate relevant privacy, data management, and practice and policies against the consumers preference profile. The bill would require the office to make the online tool available to other state agencies, including the agency.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.