Upcoming CPPA Meeting and Proposed Data Broker Rulemaking Made Public

Originally published by Truyo.

Written by Dan Clarke, President, Truyo.

The California Privacy Protection Agency (CPPA) remains actively engaged, not only in the prominent new rulemaking on automated decision-making but also in the ongoing refinement of existing policies. The CPPA will host a virtual public hearing on August 20, 2024, focusing on proposed regulations concerning data broker registration. This meeting is crucial for stakeholders as it aims to clarify and enforce the requirements outlined in Senate Bill 362, also known as the Delete Act, which transferred the responsibility of maintaining the Data Broker Registry to the CPPA.

The proposed rulemaking seeks to address common challenges faced by data brokers during the registration process and to enhance transparency for consumers regarding their data. These regulations are a key step in advancing the state’s efforts to protect consumer privacy, making the upcoming hearing a significant event for businesses and individuals alike.

Key Details of the Proposed Rulemaking

Registration and Fees:

• Data brokers are required to register annually with the CPPA by January 31, following any year they engage in data broker activities.
• The proposed regulations clarify the registration fee structure, which includes a $400 fee plus any electronic payment processing fees.
• Data brokers can pay via credit card, debit card, check, or wire transfer, but fees are non-refundable and non-prorated.

Clarification of Terms:

• The regulations define several key terms to reduce confusion:
• “Direct relationship” clarifies which businesses qualify as data brokers.
• “Minor” is defined as individuals under 16 years old, with specific conditions on how businesses ascertain age.
• “Reproductive health care data” includes examples to guide brokers on disclosure requirements.

Registration Process Enhancements:

• The CPPA proposes rules to streamline the registration process, including standardized electronic payments and clear requirements for providing accurate information.
• Each data broker, regardless of parent or subsidiary status, must uniquely register.
• Businesses must provide accurate website links, email addresses, and additional names they operate under.

Consumer Transparency and Protection:

• The proposed rules emphasize transparency by requiring data brokers to disclose the types of personal information they collect, the products and services they offer, and the laws applicable to the data they handle.
• These disclosures are intended to help consumers make informed decisions about their privacy rights, including the right to delete personal information or opt out of data sales.

Anticipated Benefits

The CPPA expects these regulations to enhance transparency in the data broker industry, giving consumers more insight into which entities are collecting and selling their personal information. By clarifying the registration process and defining critical terms, the CPPA aims to improve compliance with the California Consumer Privacy Act (CCPA) and empower consumers to exercise their privacy rights more effectively.

Public Participation and Comment Period

The CPPA encourages public participation in the rulemaking process. Interested parties can present oral or written comments during the hearing or submit written comments by 5:00 p.m. on August 20, 2024. The agency requests that oral commentators also submit a written copy of their testimony to ensure their input is thoroughly considered.

What’s Next

The proposed data broker regulations represent a significant step toward stronger consumer privacy protections in California. By addressing ambiguities in the existing legislation and enhancing the registration process, the CPPA aims to foster greater compliance and transparency within the data broker industry. The August 20 public hearing provides an important platform for stakeholders to voice their opinions and contribute to shaping the final regulations.