Josh Becker
- Democratic
- Senator
- District 13
The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, including the right to request that a business disclose specified information that has been collected about the consumer, to request that a business delete personal information about the consumer that the business has collected from the consumer, and to direct a business not to sell or share the consumer's personal information, as specified. The CCPA defines various terms for these purposes. The California Privacy Rights Act of 2020 (CPRA) , approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the Attorney General, pay a registration fee, and provide specified information on or before January 31 following each year in which a business meets the definition of data broker. Existing law defines various terms for these purposes. Existing law establishes the Data Brokers' Registry Fund and requires that these registration fees be deposited into the fund, to be available for expenditure by the Department of Justice, upon appropriation, for specified purposes. Existing law provides that a data broker that fails to register as required by these provisions is liable for civil penalties, fees, and costs in an action brought by the Attorney General, as specified, and requires these moneys be deposited in the Consumer Privacy Fund with the intent that they be used to fully offset costs incurred in connection with these provisions. Existing law requires the Attorney General to create and maintain an internet website where specified information provided by data brokers is accessible to the public. This bill would incorporate the definitions from the CCPA into the data broker provisions described above. The bill would require a data broker to register with, pay a registration fee to, and provide information to, the agency instead of the Attorney General and would require the agency to maintain the informational internet website described above. The bill would require a data broker to compile and disclose specified information relating to requests received under the CCPA. The bill would also require, on or before July 1 following each year in which a business meets the definition of a data broker, that business to provide specified information described above and make related changes. The bill would make a data broker that fails to register as required by the provisions described above liable for administrative fines and costs in an administrative action brought by the agency, as specified, instead of in an action brought by the Attorney General. This bill would require the agency to establish, by January 1, 2026, an accessible deletion mechanism that, among other things, allows a consumer, through a single verifiable consumer request, to request that every data broker that maintains any personal information delete any personal information related to that consumer held by the data broker or associated service provider or contractor. The bill would specify requirements for this accessible deletion mechanism, and would, beginning August 1, 2026, require a data broker to access the mechanism at least once every 45 days and, among other things, process all deletion requests, except as specified. Beginning August 1, 2026, after a consumer has submitted a deletion request and a data broker has deleted the consumer's data pursuant to the bill's provisions, the bill would require the data broker to delete all personal information of the consumer at least once every 45 days, as specified, and would prohibit the data broker from selling or sharing new personal information of the consumer, as specified. The bill would, beginning January 1, 2028, and every 3 years thereafter, require a data broker to undergo an audit by an independent third party to determine compliance with these provisions and would require the data broker to submit an audit report to the agency upon the agency's written request, as specified. The bill would authorize the agency to charge a fee to data brokers for accessing the accessible deletion mechanism, as specified. This bill would provide that a data broker that fails to comply with the requirements pertaining to the accessible deletion mechanism described above is liable for administrative fines, fees, expenses, and costs, as specified. The bill would require that moneys collected or received by the agency and the Department of Justice under these provisions be deposited in the Data Brokers' Registry Fund, which the bill would require to be administered by the agency, instead of the Consumer Privacy Fund and would expand the specified uses of moneys in the Data Brokers' Registry Fund to include the costs incurred by the state courts and the agency in connection with enforcing these provisions and the costs of establishing, maintaining, and providing access to the accessible deletion mechanism described above. This bill would require a data broker to provide additional information to the agency, including information related to requests received under the CCPA, whether the data broker collects specified information, and specified information regarding an audit under the provisions described above. This bill would prohibit an administrative action pursuant to these provisions from being commenced more than 5 years after the date on which a violation occurred. This bill would declare that it furthers the purposes and intent of the CPRA for specified reasons.
Chaptered by Secretary of State. Chapter 709, Statutes of 2023.
Approved by the Governor.
Enrolled and presented to the Governor at 4 p.m.
Assembly amendments concurred in. (Ayes 31. Noes 9. Page 2840.) Ordered to engrossing and enrolling.
Read third time. Passed. (Ayes 52. Noes 14. Page 3411.) Ordered to the Senate.
In Senate. Concurrence in Assembly amendments pending.
Assembly Rule 69 suspended.
Ordered to third reading.
Read third time and amended.
Read second time. Ordered to third reading.
Read second time and amended. Ordered to second reading.
From committee: Do pass as amended. (Ayes 10. Noes 3.) (September 1).
August 16 set for first hearing. Placed on suspense file.
Re-referred to Com. on APPR. pursuant to Assembly Rule 96.
Read second time and amended. Re-referred to Com. on JUD.
From committee: Do pass as amended and re-refer to Com. on JUD. (Ayes 7. Noes 0.) (June 27).
In Assembly. Read first time. Held at Desk.
Read third time. Passed. (Ayes 32. Noes 8. Page 1389.) Ordered to the Assembly.
Read second time. Ordered to third reading.
Read second time and amended. Ordered to second reading.
From committee: Do pass as amended. (Ayes 5. Noes 2. Page 1167.) (May 18).
Set for hearing May 18.
May 8 hearing: Placed on APPR suspense file.
Set for hearing May 8.
Read second time and amended. Re-referred to Com. on APPR.
From committee: Do pass as amended and re-refer to Com. on APPR. (Ayes 9. Noes 2. Page 893.) (April 25).
Set for hearing April 25.
April 18 hearing postponed by committee.
Set for hearing April 18.
From committee with author's amendments. Read second time and amended. Re-referred to Com. on JUD.
From printer. May be acted upon on or after March 11.
Introduced. Read first time. To Com. on RLS. for assignment. To print.
Bill Text Versions | Format |
---|---|
SB362 | HTML |
02/08/23 - Introduced | |
04/10/23 - Amended Senate | |
04/27/23 - Amended Senate | |
05/18/23 - Amended Senate | |
06/29/23 - Amended Assembly | |
09/01/23 - Amended Assembly | |
09/07/23 - Amended Assembly | |
09/18/23 - Enrolled | |
10/10/23 - Chaptered |
Document | Format |
---|---|
04/22/23- Senate Judiciary | |
05/05/23- Senate Appropriations | |
05/18/23- Senate Appropriations | |
05/25/23- Sen. Floor Analyses | |
06/26/23- Assembly Privacy and Consumer Protection | |
08/14/23- Assembly Appropriations | |
09/05/23- ASSEMBLY FLOOR ANALYSIS | |
09/07/23- ASSEMBLY FLOOR ANALYSIS | |
09/14/23- Sen. Floor Analyses |
Data on Open States is updated periodically throughout the day from the official website of the California State Legislature.
If you notice any inconsistencies with these official sources, feel free to file an issue.