United States of America: Signed California SB 362 on data brokers (DELETE Act)

On 10 October 2023, Senate Bill 362 (DELETE Act) was signed into law, amending Sections 1798.99.80, 1798.99.81, 1798.99.82 and 1798.99.84 of the Civil Code and adding Sections 1798.99.85, 1798.99.86, 1798.99.87 and 1798.99.89, to require data brokers to register with the California Privacy Protection Agency and to establish, by 1 January 2026, an accessible deletion mechanism enabling a consumer to request, through a single verifiable consumer request, the deletion of their personal information held by every data broker. Beginning 1 August 2026, each data broker must access the mechanism at least once every 45 days, process all deletion requests and, after a deletion request has been submitted, refrain from selling or sharing new personal information of the consumer unless permitted under Sections 1798.145 or 1798.146 or requested by the consumer; and the data broker must delete all personal information of the consumer at least once every 45 days unless an exemption applies. Beginning 1 January 2028 and every three years thereafter, each data broker must undergo an independent audit and submit the audit report to the agency upon written request, and non-compliance with registration or deletion-mechanism obligations is subject to administrative fines, fees and costs.