As we march toward January 1, 2020 I want to briefly discuss data brokers, registration by data brokers and the California Consumer Privacy Act (CCPA).
In the flurry of activity by the California legislature one bill that came out of the hopper was AB 1202, which will require data brokers to register with the California Attorney General (AG). AB 1202 is required reading as organizations work toward compliance with the CCPA to determine if it applies.
The basics:
- A “data broker” is defined as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.”
- The stated purpose of the bill is to “create a registry of data brokers so that California consumers may better know what businesses to contact in order to opt-out of the sale of their personal information.”
- The data broker will need to pay a registration fee (not yet known) and provide basic information about itself.
- Failure to register with the AG can lead to fines of $100/day for each day the data broker fails to register and payment of the expense incurred by the AG’s office to investigate/enforce the violation.
- The AG will create a webpage where data broker information will be accessible to the public.
- AB 1202, like the amendments to the CCPA, is pending on the Governor’s desk for signature.
For those entities in the background screening industry note two things. One, there is a general exception under the CCPA for activities under the Fair Credit Reporting Act (FCRA). Two, AB 1202 states that a data broker does NOT include a consumer reporting agency to the extent that it is covered by the FCRA.