The California State Legislature passed Senate Bill 362, the Delete Act, which is designed to streamline consumers' ability to request the deletion of their personal information collected by data brokers.
The proposal originally passed the California Senate 31 May before receiving approval with amendments from the Assembly 13 Sept. The bill cleared the legislature with Senate concurrence on 14 Sept., the final day of the 2023 legislative session.
The bill now awaits the signature of Gov. Gavin Newsom, D-Calif., though he reportedly has given no indication whether he will sign the bill, according to CBS News. Newsom has until 14 Oct. to sign the bill.
California Privacy Protection Agency Executive Director Ashkan Soltani said he anticipates Newsom to sign the bill.
"We're pleased the Legislature has passed SB 362, and we're looking forward to the Governor signing the bill into law," Soltani said.
Should it become law, the Delete Act would empower the CPPA to develop a system by 2026 that allows residents to make a single data deletion request across the nearly 500 registered data brokers operating in the state. The CPPA would also be charged with enforcing provisions of the Delete Act, such as requiring data broker registration and ensuring brokers delete an individual's personal information every 45 days upon receipt of a verified request.
The bill represents a major step in giving consumers more control over their personal information that gets aggregated by data brokers and sold for profit. However, the bill's skeptics and members of the digital advertising industry question if the Delete Act places an undue burden on businesses and could ultimately make California consumers more vulnerable to cyber threats.
"From a purely practical perspective, in a relatively short time period, there are now many varying privacy laws that require companies to quickly and wholly change their operations and technical infrastructure, let alone their business practices that are reliant on data," Kelley Drye & Warren Partner Alysa Hutnik, CIPP/US, said. "In the meantime, companies are devoting millions to revamp their operations to comply with these laws in good faith, knowing that realistically their interpretation of these laws may be off, and many more millions of dollars will need to be spent to course-correct based on future regulations and regulatory guidance."
The Delete Act was first introduced by state Sen. Josh Becker, D-Calif., who previously said the legislation patches a loophole in the California Consumer Privacy Act that allowed for consumers to request individual data brokers delete information obtained directly from them but did not require entities to delete personal information aggregated from other sources.
"Data brokers spend their days and nights building dossiers with millions of people's reproductive healthcare, geolocation, and purchasing data so they can sell it to the highest bidder," Becker said after the bill originally passed in the Senate in May. "The Delete Act is based on a very simple premise: Every Californian should be able to control who has access to their personal information and what they can do with it."
Author and Director of Au Kemp Ventures Tom Kemp, who advised lawmakers in drafting the Delete Act, said in wake of the Dobbs U.S. Supreme Court decision overturning Roe v. Wade, codifying the right for Californians to request the deletion of their personal information collected by data brokers is a vital necessity to ensure their privacy is protected.
"In post-abortion rights America, the selling of sensitive data such as reproductive healthcare and precise geolocation has now made things intolerable for many people," said Kemp, who is an investor in multiple companies with data deletion services. "Then, when you factor in angst that our personal data will also be fed into generative AI, there is now significant concern over the potential weaponization of data that is facilitated via data brokers' business model."
Still, opponents of the Delete Act believe it will harm consumers and businesses.
Association of National Advertisers Executive Vice President for Law, Ethics, and Government Relations Chris Oswald said the Delete Act "will encourage the mass deletion of data that is the lifeblood of California's digital economy." He added the proposed legislation would "enrich pay-to-play deletion schemes" that will cost consumers hundreds of dollars a year to pay for deletion services.
Oswald also called attention to "glaring and dramatic failures" in the bill that he said the state legislature can address early in the 2024 legislative session. A chief issue is the deletion request system, which he opined would cost the CPPA roughly 20 times its projected budget and compared its potential complexity to the U.S. Federal Trade Commission's national Do Not Call Registry.
"Without a robust data marketplace, Californians will fall victim to more fraud and identity theft as their identities can't be verified," Oswald said. "Small businesses will struggle to find customers without data-driven advertising. Non-profits will lose access to the tools to find new donors and volunteers. Government agencies will be unable to use data to effectively allocate resources and reduce waste."
Hutnik said the proposal's broad scope to require deletion of nonsensitive personal information is a "sledgehammer approach" that will likely carry unintended consequences.
"We are kidding ourselves if we do not acknowledge that there is a cost that is borne here, whether by consumers, the economy, the environment or likely all," Hutnik said. "I hope the overall privacy wins we achieve here in the end are worth the sledgehammer we are using to get there."
