California legislature passes ‘Delete Act’ to protect consumer data

On Wednesday, the California legislature passed the “Delete Act,” a first-of-its-kind law that allows the state’s consumers to universally remove their personal data from all data brokers based in the state with a single request.

The Delete Act promises to create a “one-stop shop” website where residents can request that brokers of consumer personal data delete their information from their databases. The act builds on 2018’s California Consumer Protection Act, the standard-setting consumer data privacy law that set off a tidal wave of state-level, comprehensive data privacy legislation over the last several years. While the Delete Act closes some loopholes in the CCPA, some privacy advocates worry that it will lead to the collection and retainment of more personal data.

CCPA’s building blocks

Under CCPA, California residents can opt out of having their personal data collected online and request data brokers delete the information collected about them — but they have to do so with an individual request per broker.

Additionally, there is no way for residents to request that a broker delete data they may have bought or acquired from other sources, which is a one way data brokers profit on the exchange of information. According to estimates from the consulting firm Maximize Market Research, the data broker industry is valued at over $200 billion.

The Delete Act requires data brokers to comply with a single opt-out or delete request through a website. The law tasks the California Privacy Protection Agency with administering the website, which will be free of charge for Californians to use. The law also requires audits of the data brokers to ensure requests are being honored.

CCPA mandates that data brokers register with the California Attorney General, and according to state attorney general’s website, there about 500 data brokers currently registered in California. However, the brokers don’t have to report what kinds of information they collect or sell. The Delete Act will require that brokers disclose the types of personal information they collect. Brokers that fail to adhere to the law will face civil penalties and administrative fines set by the CPPA.

Industry opinions

The Delete Act was introduced by state Sen. Josh Becker, a Democrat, in February as SB 362, and the Senate passed it in May. It was heard on the floor Wednesday and passed by a vote of 43-11 after moving through the Assembly for its third and final reading.

Becker said in news release earlier this month that his motivation to charter the legislation stemmed from concerns with the proliferation of data brokerage, which operates with little oversight, even under CCPA.

“The time of uncontrolled gambling with our personal information is almost over. Data brokers currently have the ability to use data on reproductive healthcare, geolocation, and purchasing data to sell it to the highest bidder, and the DELETE Act would protect our most sensitive information,” Becker said in the release.

Some industry groups representing data brokers have said these efforts will be counterproductive. The Consumer Data Industry Association, which represents credit bureaus and background check companies, built a website called “No to SB 362” that includes 15 reasons they claim the act would harm California and its businesses.

“SB 362 is unnecessary. It is duplicative of rights already afforded Californians. Furthermore, cost estimates for establishing and maintaining this new government program grossly underestimate the actual costs and will bloat the growing state deficit,” the website states.

Other groups said the act empowers consumers. The advocacy division of Consumer Reports this week hailed the legislation as “pro-consumer” and urged the legislature to pass it.

No ‘teeth’

Max Anderson, the chief revenue officer at a firm called 360 Privacy, which offers services like personal data monitoring and digital footprint reduction, said the Delete Act has little substance.

“I don’t really see any teeth or much enforceable action in this bill, which unfortunately, seems to be the status quo for a lot of legislation these days,” Anderson told StateScoop.

He described the current opt-out method for Californians provided by the CCPA — which requires that consumers verify their identities to data brokers before their data can be deleted. Usually, this involves the submission of additional personal information.

“My hesitation with that is if you’re trying to opt out of a company that’s selling your personal information and then they ask you to give them your personal information to do it — what happens to that?” Anderson said. “That almost becomes a data repository on its own, because they’re gonna have to save it.”

He said that the same tech companies that were not happy about CCPA may also find a way around the Delete Act, even if it requires leaving the state. Anderson conceded that at least the new law elevates awareness of the power and widespread presence of data brokers.

“If nothing else, they’re at least highlighting that this is happening,” he said. “I think most people don’t even understand that their personal information is being bought and sold multiple times per day to different data brokers.”