Locations

California Governor Newsom recently signed SB 362, known as the Delete Act, which creates a one-time mechanism for consumers to request that data brokers delete all personal data associated with the consumer. The legislation, which does not go into effect until January 2026, differs from California’s other privacy laws such as the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), although these older laws have set the ground work for the Delete Act.  The Delete Act and the previous California privacy laws define a data broker as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” To be a broker regulated by the Delete Act, brokers must meet a threshold of $25 million in annual gross revenue, buy, sell, or share the personal information of 100,000 or more consumers, or derive fifty percent or more of its annual revenues from sharing or selling consumer data. Entities covered by the Fair Credit Reporting Act, Gramm-Leach-Bliley Act, the Insurance Information and Privacy Protection Act, or covered entities under HIPAA are not considered data brokers. While the Delete Act does not give a definition for a direct relationship with consumers, other states with similar laws give the examples of consumers who use the business’s goods or services, a business’s investors or donors, or the agents, employees, and contractors of a business. The CPRA established the California Privacy Protection Agency (CPPA) and required data brokers to register with the Attorney General and pay a registration fee on a yearly basis. The Delete Act amends the CPRA by requiring registration with the CPPA instead. Additional amendments include a requirement that data brokers inform the CPPA if the broker collects the personal information of minors, consumers’ precise geolocation, or consumers’ reproductive health care data, and increases the fine for non-registration, and other requirements described below. While consumers in California and certain other states already have the right to demand that data brokers (as well as the brokers’ service providers and contractors) delete their data, the Delete Act alters the mechanism through which it is done in California. Under current law, consumers need to separately request that each individual data broker delete their data. Since consumers may interact with numerous data brokers in a single day, this could be an onerous process. The Delete Act therefore creates a single platform for consumers to request that any personal information held by any in-scope data broker be deleted, barring some exemptions. Consumers also have the choice to exclude specific brokers from their deletion requests. The new mechanism is more akin to the Do Not Call Registry rather than the old model of individual consumer submissions. Starting in August of 2026, data brokers (as well as their service providers and contractors) will have forty-five days to process the deletion requests, and must delete any new data regarding the consumer every forty-five days thereafter. In addition, they must not sell or share any new personal information they obtain regarding the consumer. On January 1, 2028 and every three years thereafter, an independent audit will be run on data brokers to determine whether they are in compliance with the Delete Act. Failure to delete the verified requests will result in a $200 fine per deletion request for every day the broker is out of compliance, as well as the agency’s fees, expenses and costs. Failure to register with the CPPA, will also result in a fine of $200 for each day of non-registration, along with the agency’s fees, costs and expenses. While the Delete Act will be the most comprehensive data broker registration law, three other states currently have passed legislation similar to the existing data broker requirements under the CCPA. Vermont implemented their data broker law in 2018, which requires brokers to register with the state, maintain adequate cybersecurity measures, and destroy data no longer in use by the broker. Texas recently passed a law which went into effect September of 2023 that implemented a data broker registry and data protection obligations. Oregon’s data broker law, which goes into effect in January of 2024, requires data brokers to register and pay a fee, as well as let consumers know whether they can opt out of their data collection. The data brokers must also describe how consumers can opt out if they choose to do so. See the full text of the Delete Act at Bill Text - SB-362 Data broker registration: accessible deletion mechanism. (ca.gov). If you have any further questions regarding the Delete Act, please contact Dorsey’s data privacy team.

The California Court of Appeal, Fourth District, Division One, issued the following published decision: McConnell et al. v. Advantest America, Inc., et al., Case No. D080532: In this decision, the Court of Appeal held that an arbitrator abused their discretion by issuing a “hearing” subpoena compelling non-parties’ document production but not their testimony. The arbitrator in a business dispute issued “hearing” subpoenas summoning non-parties to appear at a hearing “for the limited purposes of receiving documents.” The subpoenas expressly provided that after the non-parties produced the documents, the “hearing” would adjourn, and the non-parties would be summoned to testify at a later date. Rejecting the non-parties’ objections that the subpoenas improperly sought pre-hearing discovery, the arbitrator issued an order compelling compliance. The trial court declined to vacate the order, finding that the subpoenas were permissible “hearing” subpoenas under California Code of Civil Procedure section 1282.6(a), the California Arbitration Act (CAA) provision authorizing arbitrators to issue subpoenas requiring witnesses’ attendance and production of documents “at an arbitration proceeding.” (Emphasis added). The non-parties appealed the order, arguing that the trial court erred by failing to consider the subpoenas’ purpose regardless of their “hearing” labels: to end-run the restriction on pre-hearing discovery from non-parties. The Court of Appeal agreed, reversing and remanding with instructions for the trial court to vacate the arbitrator’s order. The court noted that while California courts have restricted arbitrators’ authority to compel non-party document production through “discovery” subpoenas, none addressed whether an arbitrator may issue a subpoena that calls for pre-hearing discovery in all but name. See Aixtron, Inc. v. Veeco Instruments, Inc., 52 Cal. App. 5th 360 (2020). The court clarified that to be a “hearing” subpoena under section 1282.6, the subpoena must compel a non-party to appear for the purpose of giving testimony. While section 1282.6 permits an arbitrator to issue a “hearing” subpoena that requires a non-party to produce documents at the hearing, it does not permit arbitrators to issue a “hearing” subpoena “for the purposes of” obtaining non-party discovery. Here, that the “hearing” would last only “so long as needed for the documents to be collected” from the non-parties made the subpoenas impermissible under the CAA. Read the full opinion.