United States of America: Signed California SB 362 on data brokers (DELETE Act)

On 10 October 2023, Senate Bill 362 to amend Section 1798.99.82 of the Civil Code relating to data brokers (DELETE Act) was signed into law by the California Governor, Gavin Newsom. The Bill requires all data brokers to register and exchange information with the California Privacy Protection Agency (CPPA) instead of the Attorney General. In particular, the Bill requires the CPPA to establish an accessible deletion mechanism that allows consumers to request the deletion of their data by every data broker that maintains any of it through a single verifiable consumer request. Beginning 1 August 2025, data brokers will be required to access the mechanism at least once every 31 days, paying a fee to the CPPA to do so and, among other things, process all pending deletion requests. Beginning 1 July 2025, data brokers will be forbidden from collecting, retaining, selling, or sharing personal information on a consumer who has submitted a deletion request unless requested by the consumer. Beginning 1 January 2027 and every three years thereafter, all data brokers will be required to undergo an audit by an independent third party to determine compliance with these provisions and to submit an audit report to the agency. Data brokers not compliant with the above will be liable for civil penalties, administrative fines, fees, and costs.