The Prospect of Erasing Personal Data from Data Brokers: A California Initiative Nears Reality

26

Many may be unaware, but numerous often opaque corporations habitually engage in the trade of personal information that you likely never consented to disclose. This includes a range of data from your immediate geographical location to confidential financial particulars. Even within California, a state noted for its robust digital privacy legislation, individuals have had little recourse to control such activities.

However, the situation is nearing a pivotal shift. Both chambers of the California State Legislature have given their approval to the Delete Act. This legislation aims to create a centralized portal through which residents can direct the erasure of their personal information from the databases of hundreds of registered data brokers in the state, all via a single request. Moreover, these brokers would be mandated to cease future collection and sale of the data.

Although the Delete Act has passed the legislature, it still awaits the signature of Democratic Governor Gavin Newsom. Given California’s past role as a trendsetter in legal matters, the repercussions of this act could potentially influence policy beyond the state’s borders.

What You Should Know

Presently, while Californian law allows individuals to ask for data removal, the process is cumbersome and inefficient. Each request must be separately made to every data broker registered in California, many of which have distinct protocols for managing these requests. Furthermore, there is no legal barrier preventing these companies from subsequently recollecting the same data.

The Delete Act proposes that the newly formed California Privacy Protection Agency would establish a website. Through this platform, consumers could authenticate their identities and initiate a single deletion request that affects all registered data brokers, effectively opting out of future data collection and sale. Advocates liken this to a “do not track” mechanism, akin to the Federal Trade Commission’s “do not call” list for telemarketers.

While California already has regulations for data brokers, the Delete Act seeks to bolster existing rules. It mandates that companies reveal more details about the consumer data they collect and strengthens state enforcement mechanisms.

Understanding Data Brokers

The Electronic Privacy Information Center, a non-profit organization headquartered in Washington D.C. focused on enhancing privacy rights, categorizes data brokers as enterprises that accumulate and classify personal information. This often involves constructing detailed profiles on countless Americans, which are then leased, sold, or employed in service provision.

According to EPIC, these profiles can comprise a host of data points ranging from names, addresses, and telephone numbers to more sensitive information such as health records, political inclinations, and even real-time location data collected through smartphones and wearable devices.

Privacy advocates have persistently cautioned that this collection of seemingly innocuous personal information could be used to identify individuals. They argue that data security is often lax and that current laws are insufficient in requiring explicit consumer consent for data collection.

Controversies Surrounding Data Brokers

According to industry representatives, data brokers serve an essential function and are often unfairly criticized. Dan Smith, president of the Consumer Data Industry Association, has denounced the Delete Act as fundamentally flawed. Smith contends that the legislation may compromise consumer fraud protections, adversely affect the competitiveness of small enterprises, and favor large platforms like Facebook and Google, who collect but do not sell consumer data.

Additionally, the organization warns that the central deletion mechanism proposed in the act could become an avenue for fraud, enabling impersonators to erase consumer data without authorization.

The Dark Side of Data Brokerage

On another note, the data accumulated by these brokers can be highly susceptible to misuse. In the United States, where legal constraints on broker activities are relatively lenient, there is little to stop unauthorized access to personal information. This has had ramifications for public figures and everyday citizens alike.

For example, in mid-2021, Monsignor Jeffrey Burrill, a high-ranking official of the U.S. Conference of Catholic Bishops, resigned after a report by The Pillar, a Catholic news outlet, revealed information about his private life obtained through commercially available location data. Such incidents underscore the potential for abuse inherent in the data broker industry.

Frequently Asked Questions (FAQs) about Delete Act

More about Delete Act

• California State Legislature’s Official Text on the Delete Act
• Electronic Privacy Information Center (EPIC) on Data Brokers
• California Privacy Protection Agency Official Website
• Federal Trade Commission’s “Do Not Call” List
• Consumer Data Industry Association’s Statement on the Delete Act
• The Pillar’s Report on Monsignor Jeffrey Burrill
• California Privacy Laws Overview