California’s Governor Gavin Newsom has several legislative bills awaiting his signature which will impact the upcoming California Consumer Privacy Act set to go into effect January 2020. In this six part series, we will break down each of the proposed amendments and what this means for businesses as they get ready for compliance by the end of 2019.

________________________________________________________________________________________________________________

California recently passed several amendments to the California Consumer Privacy Act (“CCPA”). One of them, Assembly Bill No. 1202, takes aim at data brokers. If you are a data broker or are unsure if you are one, here is what you need to know to protect yourself.

What is a Data Broker?

AB 1202 defines “data broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” AB 1202 states that there are important differences between data brokers and businesses that have direct relationships with consumers. For example, consumers who have direct relationships with business can, among other things, opt out of having their personal information shared.

However, AB 1202 does not specifically define what a “direct relationship” is. Rather, it merely gives a few examples of what can lead to a finding that there is a “direct relationship,” such as “by visiting a business’ premises or internet website, or by affirmatively and intentionally interacting with a business’ online advertisements.” It should be noted that AB 1202 specifically states that most consumer reporting agencies and financial institutions are excluded from its purview. As to all other businesses, whether or not they fall within the purview of AB 1202 will likely be decided on a case by case basis.

Registration Requirement

AB 1202 mandates that a data broker register with California’s Attorney General by January 31 of the year following the first year it began conducting business as a data broker. The registration entails the data broker providing its name, primary physical address, internet website, and e-mail. The Attorney General will compile that information with similar information from other data brokers and make it publicly available online to consumers.

Importantly, a data broker does not need to provide information regarding how a consumer can decline having their personal information sold by the data broker. A data broker must also pay a registration fee as determined to be necessary by the Attorney General to pay the costs of establishing and maintaining the database.

Penalties

A data broker who does not heed AB 1202’s mandate to register risks being exposed to injunctive relief, monetary penalties, and court costs incurred in an enforcement action brought by the Attorney General. The civil penalty is $100 for each day a data broker fails to register as such with the Attorney General. Penalties, fees, and expenses recovered by the Attorney General will be deposited in the Consumer Privacy Fund, which will be used to offset costs incurred by the courts and the Attorney General in relation to AB 1202.

Data Brokers – Start Now!

If you are a data broker, do not wait. Register with the Attorney General as soon as reasonably possible to avoid incurring penalties next year. If after reading this you are uncertain whether you are a data broker pursuant to AB 1202, consult with an attorney right away. As new, restrictive privacy laws are a clear trend, businesses need to protect themselves by staying up to date on the latest developments.