SB 393

Abstract

Consumer Data Protection Act; data deletion request. Provides that a controller that has obtained personal data about a consumer from a third party shall be deemed in compliance with a consumer's request to delete such data if the controller either (i) retains a record of the deletion request and the minimum data necessary for the purpose of ensuring that the consumer's personal data remains deleted and does not use such retained data for any other purpose or (ii) opts the consumer out of the processing of that data for any purpose except those purposes exempted pursuant to the Consumer Data Protection Act. This bill is identical to HB 381.

Consumer Data Protection Act; data deletionrequest. Authorizes a controller of personal data to treat a consumer request to delete data obtained by a third party about aconsumer as a request to opt the consumer out of the processing ofthat data for (i) targeted advertising, (ii) the sale of personaldata, or (iii) profiling in furtherance of decisions that producelegal or similarly significant effects concerning the consumer.