California: Bill allowing Californians to easily obtain deletion of data from data brokers passes Senate and proceeds to Assembly
Senate Bill 362 for an act relating to data brokers was re-referred, on July 10, 2023, to the California Assembly Committee on Appropriations, having been passed with amendments by the Assembly Privacy and Consumer Protection and Judiciary Committees. The bill was first introduced to the California Senate on February 8, 2023, where it was approved with amendments, on May 31, 2023, before proceeding to the Assembly. In particular, the bill would require the California Privacy Protection Agency (CPPA) to establish, by January 1, 2026, an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. To this end, the bill would require a data broker to register with, pay a registration fee to, and provide information to the CPPA, instead of the California Attorney General.
In addition, the bill would specify requirements for the accessible deletion mechanism in question, and would, starting from August 1, 2026, require a data broker to access the mechanism at least once every 31 days and, among other things, process all deletion requests, except as specified. Under the bill, from July 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer's data, a data broker would need to delete all personal information of the consumer at least once every 31 days and would prohibit the data broker from selling or sharing new personal information of the consumer, unless the consumer requests otherwise.
In this context, California Senator Josh Becker, who introduced the bill, stated, in a press release issued on April 11, 2023, that "[d]ata brokers spend their days and nights mining for personal information so they can build dossiers on millions of people and sell them to the highest bidder," adding that the bill "is based on a very simple premise: every Californian should be able to control who has access to their personal information and what they can do with it."
Separately, on July 19, 2023, the CPPA announced that its board unanimously voted to support the bill.
Update: September 5, 2023
DELETE Act passes Assembly Committee
On September 1, 2023, Becker announced that, on the same day, the Assembly Appropriations Committee voted to advance the bill to the Assembly Floor.
Update: September 7, 2023
DELETE Act proceeds to third reading in Assembly
On September 5, 2023, the bill was read for a second time by the Assembly and ordered to its third reading.
Update: September 14, 2023
DELETE Act sent to Senate for concurrence with Assembly amendments
On September 13, 2023, the bill was sent back to the Senate for concurrence with the amendments made in the Assembly.
Update: September 15, 2023
DELETE Act passes both houses
On September 14, 2023, the Senate concurred with the amendments introduced by the Assembly to the bill, which was thereafter ordered to engrossing and enrolling.
Update: October 11, 2023
DELETE Act signed into law
The Governor of California, Gavin Newsom, announced, on October 10, 2023, that they had signed the bill into law.
Update: October 12, 2023
CPPA welcomes DELETE Act
On October 11, 2023, the California Privacy Protection Agency (CPPA) issued a statement welcoming the DELETE Act. The CPPA noted that the DELETE Act, which will go into force on January 1, 2024, transfers the administration, enforcement, and rulemaking authority over California's data broker registry from the California Department of Justice to the CPPA.
Notably, the CPPA highlighted that California is the first state to pass a law to create an accessible deletion mechanism for consumers to delete their personal information held by data brokers in a single step.
You can read the statement here.