California’s Data Privacy Act: Power to the People!

California on the Verge of Empowering Consumers Against Data Brokers

September 14, 2023

California, already recognized for having some of the strongest digital privacy laws in the United States, is on the cusp of offering its residents an innovative tool to combat the sale and secret use of personal information they never agreed to share. The state legislature has passed the Delete Act, a landmark legislation that would establish a “one stop shop” for individuals to order data brokers to delete their personal data and cease acquiring and selling it in the future with a single request. Although the Delete Act still needs to pass a second vote in the state Senate and be signed by Governor Gavin Newsom, its potential impact extends beyond state borders thanks to California‘s track record of setting trends in digital privacy legislation.

Understanding the Delete Act

The current California law grants individuals the right to request data deletion, but the process is laborious and fragmented. Each data broker registered in the state has its own unique requirements for handling deletion requests, making it difficult for individuals to exercise their privacy rights. Additionally, even if data is deleted, there’s no guarantee that brokers will not reacquire it. The Delete Act aims to simplify the process by requiring the California Privacy Protection Agency to establish a website where consumers can verify their identities and submit a single request to delete personal data held by registered data brokers and opt out of future tracking. Proponents of the Delete Act compare it to the “do not call” list for telemarketers maintained by the Federal Trade Commission.

Furthermore, the legislation enhances existing regulations by mandating that data brokers disclose more information about the data they collect on consumers and strengthening the state’s enforcement mechanisms.

The Data Broker Landscape and Concerns

Data brokers are companies that collect and categorize personal information, creating profiles on millions of individuals which they rent, sell, or use to provide services. The range of data collected by these brokers is extensive, encompassing information such as names, addresses, telephone numbers, email addresses, gender, age, marital status, education, profession, income, political preferences, and even details about owned cars and real estate. Moreover, data brokers collect and sell real-time location data, capturing individuals’ purchases, shopping patterns, online activity, and advertising interactions.

Privacy advocates have long warned about the potential misuse and security vulnerabilities associated with data broker activities. They argue that seemingly innocuous data, when combined and utilized without proper safeguards, can be used to identify individuals. Additionally, they raise concerns about the lax security measures employed by data brokers and the lack of legal requirements for clear consent from individuals being tracked.

Debating the Role of Data Brokers

Data brokers defend their practices as essential to consumer needs. The Consumer Data Industry Association, representing the consumer reporting industry, dismisses the Delete Act as “severely flawed” and argues that it could have unintended consequences, including undermining consumer fraud protections, harming small businesses, and consolidating power among dominant platforms like Facebook and Google, which collect vast amounts of consumer data without selling it. The association’s president, Dan Smith, also raised concerns about potential unauthorized deletion of consumer data by malicious actors, although he did not provide further details or explain the motivations behind such actions. It’s worth noting that credit reporting agencies such as Experian, Equifax, and TransUnion—the primary entities in credit evaluations—are exempted from the Delete Act.

The Abuse of Data Broker Information

The potential for abuse of the data collected by data brokers is a significant concern. Due to the lack of legal restrictions on their activities, there is little to prevent outsiders from exploiting the vast amount of data these companies hold. This has the potential to enable unwanted surveillance or even malicious intent towards targeted individuals.

An alarming incident occurred in mid-2021 that exemplified the potential harm arising from data broker information. The U.S. Conference of Catholic Bishops announced the resignation of Monsignor Jeffrey Burrill, a top administrative official, following a report by The Pillar, a Catholic news outlet, which investigated his private romantic life. The Pillar claimed to have obtained Burrill’s location data from an unnamed vendor, correlating it with his phone to conclude that he had visited gay bars and private residences while using a dating app popular among gay individuals. The report alleged “serial sexual misconduct” by Burrill, a violation of Catholic doctrine. Although Burrill resumed his ministry after an extended leave, this incident highlights the potential harm caused by the misuse of personal information acquired through data brokers.

Conclusion: The Future of Data Privacy

The passing of the Delete Act in California represents a significant step toward empowering individuals to regain control over their personal information and protecting their privacy from data brokers. While data brokers argue for the necessity of their services, concerns regarding the misuse and security of personal data persist. It is crucial for regulators and lawmakers to strike a balance that allows for responsible data practices, transparency, and the protection of consumer rights.

Should the Delete Act become law, it could pave the way for legislative initiatives in other states and potentially spark a broader conversation about the responsible collection and use of personal data at the national level. The role of data brokers and the scope of their activities, alongside the ethical and legal considerations of data privacy, will continue to be subjects of ongoing debate and examination.

As individuals, it is essential for our own security to be mindful of the personal information we share online and to stay informed about the policies and practices of companies handling our data. While legislation can provide vital protections, our vigilance and awareness are crucial in safeguarding our digital lives.