In 2019, the California State Legislature passed Assembly Bill No. 1202 (“A.B. 1202”), amending the California Consumer Privacy Act (“CCPA” or the “Act”). The amendment requires qualified businesses to register as data brokers with the Office of the California Attorney General (“OAG”). Data brokers that fail to register are subject to civil penalties.
Who is a Data Broker?
A.B. 1202 defines a “Data Broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” It exempts most entities subject to regulation under the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Insurance Information and Privacy Protection Act, respectively.
Before registering, businesses must first determine whether they meet the “Data Broker” definition. Data brokers are defined as those that (1) knowingly share or “sell” personal information with/to third parties, and (2) do not have a “direct relationship” with the subject consumers. The amended CCPA regulations define selling as the “renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating . . .” consumer information for monetary or other valuable consideration. In addition, the Act explains that direct relationships can form in “a variety of ways such as by visiting a business’ premises or internet website, or by affirmatively and intentionally interacting with a business’ online advertisements.” All businesses that satisfy these two requirements should register as data brokers with the OAG.
Data Broker Registration Process
Businesses must register as data brokers through the OAG website. Before filing a data broker registration form, a representative of the business (e.g., an attorney) must create an account. Thereafter, the representative is required to submit the applicable data broker’s name, email address, URL, physical address, links to opt-out and data deletion request forms, and any additional information that may be related to the applicable business’s data collection practices.
Registration forms will be evaluated by the OAG. Once accepted, invoices to pay the $360.00 filing fee will be sent to the business representatives. Please note that the data broker’s registration information will be publicly available on the OAG’s website.
Data brokers that fail to register with the Office of the California Attorney General are subject to injunctions, civil penalties, and costs related to any investigation and/or prosecution. At present, California and Vermont are the only two states that have data broker registration requirements. It is recommended that companies operating in the data broker space retain qualified legal counsel to help navigate the existing and emerging issues presented by applicable state and federal privacy laws.
If you are interested in obtaining assistance with complying with state and federal data collection, storage and usage laws, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.
The material contained herein is provided for information purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.
Attorney Advertising
This blog was originally published on January 16th, 2020 and updated on March 10, 2022 for comprehensiveness.
Photo by ThisisEngineering RAEng on Unsplash
Related Blog Posts:
CCPA Law: The Private Right of Action
CCPA Service Provider Requirements Clarified by California AG
