Consumer Reports submitted comments to the California Privacy Protection Agency (CPPA) in response to its Proposed Data Broker Regulations. Administration of California’s data broker registry was transitioned from the California Attorney General to the CPPA in January of this year. The proposed rules are responsive to various ambiguities and questions that have arisen since the CPPA’s assumption of its new responsibilities, as well as the existing requirements’ relation to the Delete Act.
Consumer Reports is supportive of the Agency’s efforts to provide additional clarity for consumers and businesses about the scope of data brokers’ registration responsibilities under the Delete Act.
In particular, Consumer Reports supports:
- The proposed definition of “direct relationship,” which clarifies that businesses are still required to comply with the Delete Act when they sell personal information about the consumer that they did not collect directly from the consumer.
- The proposed requirement for an employee or agent for the data broker to register on behalf of the data broker and to have sufficient knowledge of their practices to provide accurate information under penalty of perjury.
- The proposed requirement for data brokers to disclose the types of personal information, products and services, and the proportion of data collected and sold that are subject to other laws that qualify data brokers to claim an exemption.
To read the full letter, please see the attached PDF.