California’s DELETE Act Protects Us From Data Brokers

When it comes to the reckless trade of our personal information, data brokers are the problem. These entities collect then sell personal information they’ve amassed on individuals with very little oversight. This includes very sensitive information such as buying habits, financial records, social media activity, or precise geolocation information. Scams, identity theft, and financial exploitation result from the collection and misuse of personal information.

Potential misuse of health data could lead to real harms in harassment, discrimination, and legal consequences for those seeking health services in California, including reproductive and gender affirming healthcare data. And if information is sold to local, state, or federal agencies, that puts our Fourth Amendment rights at risk.

That’s why EFF is a proud supporter of S.B. 362, authored by California State Senator Josh Becker. It allows people to easily and efficiently make one request to delete their personal information held by all data brokers registered in California. It is also known as the California Delete Act and is sponsored by Privacy Rights Clearinghouse and Californians for Consumer Privacy. It will improve everyone’s privacy rights and make California’s consumer privacy laws more user-friendly.

Californians have a right to request that companies delete information collected about them. But, logistically speaking, this is difficult. Because California’s privacy laws require people to file requests with each individual company that may have their information, it can be an incredibly time-consuming and tedious process. Furthermore, because data brokers buy, sell, and exchange information with so many companies (and each other), it’s very hard for anyone to know if a particular company has their information and how to make a deletion request.

S.B. 362 directs the California Privacy Protection Agency to create a deletion mechanism for data brokers that allows someone to make this request of every data broker with a single, verifiable consumer request. This gives us all a much-needed method to exercise our privacy rights. It also helps us gain better control over our data and makes it easier to mitigate the risks that the collection and sale of personal information create in our everyday lives.

We need this legislation to start holding these companies accountable.

The California Delete Act would also strengthen current California law that requires data brokers to register with the state. Specifically, S.B. 362 would require data brokers to report a broader set of information about what data they collect on consumers and strengthen enforcement mechanisms against data brokers who fail to comply with the reporting requirement. Both provisions do important work to shed light on this opaque ecosystem.

The bill is currently headed to the California Assembly Appropriations Committee. We call on California’s legislature to pass this bill to empower all Californians to gain a better grasp on their own privacy.