data broker

California Data Broker Registration Requirements

January 16, 2020 by David Klein

January 16th, 2020

In September 2019, the California State Legislature passed Assembly Bill No. 1202 (“A.B. 1202”), amending the California Consumer Privacy Act (“CCPA”). The amendment requires qualified businesses to register as data brokers with the California Attorney General on or before January 31, 2020. A.B. 1202 defines “Data Broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” (emphasis supplied). A.B. 1202 carves out exemptions from the data broker registration requirement for most entities subject to regulation under the federal Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, and the Insurance Information and Privacy Protection Act, respectively.

Who is a Data Broker and what are the data broker registration requirements?

[Read More]

CCPA Amended to Require California Data Broker Registration

September 23, 2019 by David Klein

September 23, 2019

On September 13, 2019, the California State Legislature passed Assembly Bill No. 1202 (the “Bill”), amending the California Consumer Privacy Act (“CCPA”) to require certain businesses to register as data brokers with the State Attorney General’s Office. The Legislature believes that a California data broker registry will provide greater transparency on the issue of third parties that may have access to their personal information (companies that they do not have a first party relationship with the consumer) and allow consumers to prospectively opt out of the “sale” of this personal information. The CCPA defines “sale” in a very broad fashion, such that it includes the “selling, renting, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or third party for monetary or other valuable consideration.” In practice, this means that a disclosure of almost any kind (other than to pure service providers) falls within the definition. We can, therefore, assume that in the context of the CCPA, selling really means sharing and should be treated as such. The Bill has moved to Governor Gavin Newsom’s desk, who now has until October 13, 2019 to act on the legislation.

What is required of California Data Brokers?

California Data Broker Definition

The Bill defines a California data broker as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Exempt from the definition are: 1) consumer reporting agencies that are covered by the federal Fair Credit Reporting Act; 2) financial institutions covered by the Gramm-Leach-Bliley Act; and 3) entities covered by the Insurance Information and Privacy Protection Act. A “direct relationship” is not defined in the Bill, but the Legislature has stated that direct relationships can form for various reasons, “such as by visiting a business’ premises or [I]nternet website, or by affirmatively and intentionally interacting with a business’ online advertisements.”

Registering as a California Data Broker

Businesses that meet the definition of California data broker must register annually with the Attorney General on or before January 31. Registration will require California data brokers to: 1) pay a fee that will be determined by the Attorney General; 2) provide their primary physical, email, and Internet website addresses; and 3) include any additional information that they choose to include with respect to their data collection practices. Failing to register as a California data broker may result in a civil penalty of $100 for each day that the California data broker fails to register its business, payment of the registration fee, and any expenses incurred by the Attorney General’s Office to investigate and prosecute any associated regulatory action.

As early as 2012, the Federal Trade Commission (“FTC”) had suggested that legislation should be initiated at the federal and state level to regulate the data broker industry. Currently, Vermont is the only other state of the Union that requires data broker registration. As more states look to follow the lead of California and Vermont in requiring consumer data broker registration, businesses should seek the advice of qualified legal counsel to help navigate the existing and emerging issues presented by applicable state laws.

If you are interested in learning more about this topic or ensuring that your business is compliant with state and federal data collection, storage and usage laws, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

The material contained herein is provided for information purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

Vermont Data Broker Registration Due January 31, 2019

January 31, 2019 by David Klein

January 31, 2019

On May 22, 2018, the State of Vermont enacted House Bill Number 764 (the “Bill”) to, among other things, regulate how Vermont data brokers collect consumer data and sell that information to third parties. The Bill went into effect on January 1, 2019, giving Vermont data brokers until January 31, 2019, to register as data brokers with the Vermont Secretary of State. If data brokers fail to register (and pay the annual $100 registration fee), they are subject to a penalty of $50 per day until registered, not to exceed a penalty of $10,000 per annum. In addition to registration fees, Vermont data brokers are required to annually provide information concerning their data collection activities, opt-out policies, purchaser credentialing practices, and any security breaches.

Who are data brokers within the meaning of the Bill? [Read More]

Wireless Carriers to Limit Sale of Location Data to Data Brokers

July 3, 2018 by David Klein

July 3, 2018

Verizon Wireless (“Verizon”) recently announced that it would end the sale of cell phone owners’ real-time location data to companies that buy and sell access to consumer location data. Within days of Verizon’s announcement, AT&T, Sprint, and T-Mobile piggy-backed on Verizon’s move by announcing that they too plan to limit and/or end sales of location data to data brokers. These wireless carriers—the four largest in the United States—have drawn criticism for the sale of cell phone owners’ location data to data brokers, as this information can be used to identify the whereabouts of almost any cell phone in the United States within seconds.

What motivated these wireless carriers to end sales to data brokers?

[Read More]

New Vermont Data Broker Law

June 1, 2018 by David Klein

June 1, 2018

On May 22, 2018, the State of Vermont enacted the country’s first law of its kind: a regulatory scheme governing data brokers. Data Brokers search for and collect consumer data points from multiple sources and sell that information to service providers, such as marketing companies, political campaigns, and credit reporting agencies. In enacting House Bill Number 764 (the “Data Broker Law”), the Vermont Legislature expressed its intention to provide consumers with more information about data brokers, their respective collection practices, the right to opt out from data collection, and to ensure that data brokers have implemented adequate security measures.

What Obligations do Data Brokers have under Vermont’s Data Broker Law?

[Read More]

FTC Settles with Data Broker

December 5, 2016 by David Klein

December 5, 2016

On November 30, 2016, the Federal Trade Commission (“FTC”) announced a settlement with Jason A. Kotzker, the purported owner and member of two separate data broker companies: Sequoia One, LLC and Gen X Marketing Group, LLC. Kotzker was the final defendant to settle an action commenced by the FTC last August. According to the FTC’s complaint, in some instances, Kotzker’s companies purchased payday loan applications from websites that offered to help consumers find payday lenders. In other instances, it was alleged, Kotzker’s companies established phony websites offering to match consumers looking for payday loans with lenders. In all instances, Kotzker’s companies obtained consumer personally identifiable information including social security numbers. Instead of connecting these consumers with payday lenders, Kotzker’s companies sold the applications to non-lender third parties. According to the FTC, those third parties fraudulently withdrew funds from consumer bank accounts for financial services products that were never purchased by the affected consumers. As a result, the FTC sued Kotzker, his companies, and other partners for violation of the FTC Act. Kotzker’s companies previously defaulted, and the other individually named defendants have settled.

What are the Terms of the FTC’s Settlement with the Data Broker?

[Read More]

FTC Recommends Congress Adopt Sweeping Legislation Aimed at Data Brokers

May 29, 2014 by David Klein

On May 27, 2014, the Federal Trade Commission (“FTC”) released a report entitled Data Brokers: A Call for Transparency and Accountability (the “Report”). The Report codified the FTC’s findings after a study initiated in December 2012, involving nine (9) data brokers. In proposing legislation aimed at data brokers, the FTC segmented the industry into three (3) distinct product categories: marketing products, risk mitigation products and people search products. The degree of oversight suggested by the FTC varies based on the category of services. If Congress takes up the FTC’s call for more transparency in the data broker industry, data brokers will find themselves facing increased federal oversight involving their business practices.

Proposed Data Broker Legislation Targeting Marketing Services

The FTC study involved five (5) data brokers that sell “marketing products”- products where businesses can purchase customer email addresses and other personally identifiable information (“PII”) from data brokers so that they can send email solicitations or market specific products to them. With respect to data brokers offering these services, the FTC recommended that data brokers be required to provide consumers with access to their data and the ability to opt out of having it shared for marketing purposes. In making this recommendation, the FTC suggested that Congress create a centralized mechanism, such as an Internet portal, where data brokers would identify themselves, describe their information collection and use practices, and provide links that consumers could use to access information tools and opt-out functionality. The FTC further advised Congress to require data brokers to provide enough detail that would allow consumers to see the breadth of categories that specific data brokers have about them, including sensitive data.

In its Report, the FTC has also proposed that Congress pass legislation requiring data brokers to clearly disclose on their respective websites that they collect raw data, such as address, age and income range of individuals, and that they use this data to derive certain inferences about consumers. The proposed legislation would require that data brokers also clearly disclose the names and/or categories of their data sources so that consumers are better able to determine if they need to correct and/or delete certain publicly available information.

Finally, the FTC recommended that Congress require that consumer-facing sources provide prominent notice to consumers that they share consumer data with data brokers and give consumers choices, such as the ability to opt out of the sharing of their information with data brokers. The FTC went on to recommend that Congress require consumer-facing sources to obtain “affirmative express consent” before collection and sharing of “sensitive information” (such as health information) with data brokers.

Proposed Data Broker Legislation Targeting Risk Mitigation Services

Four of the data brokers that were investigated by the FTC offer risk mitigation products, that is, products that businesses use to verify their customers’ identities to protect against fraud. In the Report, the FTC acknowledged that the Fair Credit Reporting Act (“FCRA”) already broadly applies to data brokers offering risk mitigation services. Nevertheless, the FTC has recommended that Congress pass legislation requiring that if a risk mitigation product adversely impacts a consumer’s ability to complete a transaction or obtain a benefit, the consumer-facing company should identify its data broker sources. These data brokers, in turn, should give consumers the right to access the information that they have on file for them and correct any inaccurate information as appropriate.

Proposed Data Broker Legislation Targeting People Search Products

Data brokers that offer people search products typically provide websites or services where users can search for publically available information on individuals. For data brokers that offer these services, the FTC recommends that Congress pass legislation requiring data brokers to provide individuals with access to their personnel information and provide the ability to opt out of the use of this information. In addition, the FTC recommends that data brokers be required to clearly disclose the sources of their information and any limitations associated with consumer opt out requests, such as the fact that close matches of an individual’s name may continue to appear in search results.

Protect Yourself

The Report is a clear sign that the FTC is taking a hard look at the data broker industry. Although the Report calls for new legislation, which Congress may take up, it is important to remember that there are existing federal laws, such as the FCRA, which the FTC can presently use to restrict the practices of data brokers.

If you are interested in learning more about this topic, or if you have been served with legal process relating to your data broker or marketing practices, please e-mail us at info@kleinmoynihan.com or call us at (212) 246-0900.

The material contained herein is provided for informational purposes only and is not legal advice, nor is it a substitute for obtaining legal advice from an attorney. Each situation is unique, and you should not act or rely on any information contained herein without seeking the advice of an experienced attorney.

Attorney Advertising

FTC Targets Data Broker Industry

December 19, 2013 by David Klein

If it was not clear before, the Federal Trade Commission (FTC) provided further evidence to Congress yesterday of how seriously it takes violations of the Fair Credit Reporting Act (FCRA). We’ve previously written about the warnings letters that the FTC mailed to data brokers earlier this year and the FTC’s decision to begin focusing on the privacy practices of the data brokerage industry generally. It appears that the FTC has no intention of decreasing its enforcement action in the data broker space. Judging by the $30 Million in civil penalties imposed upon various data brokers in the aggregate for violations of the FCRA last year, the FTC’s comments yesterday should be heeded by everyone in the data brokerage business.

FCRA Generally

The FCRA was created to protect consumer privacy and to ensure that those who collect, distribute and sell consumer information – called consumer reporting agencies (CRAs) – properly verify the identities of the parties requesting such information and confirm that such parties have a lawful purpose for receiving and using consumer information.

FTC’s Most Recent Comments

Yesterday, FTC Consumer Protection Director Jessica Rich emphasized the FTC’s concern that consumers are usually unaware of the type and extent of personal information collected and shared by data brokers. Director Rich emphasized the FTC’s focus on giving consumers greater control over how their information is collected and used by data brokers, including giving consumers better access to the data maintained about them.

In an effort to increase the level of consumer transparency present within the industry, the FTC introduced a three-pronged plan of attack: 1) aggressive enforcement of the FCRA; 2) the issuance of further compliance reports and directives; and 3) continuing to educate consumers about their data and information rights.

Takeaway and Best Practices for Data Brokers

While there are still several types of entities that are not covered by the FCRA, the FTC revealed that the data broker industry is in its crosshairs and the comments of Director Rich serve as a not-too-subtle reminder for the companies to re-evaluate their verification procedures in accordance with the requirements set forth by the FCRA. Considering the FTC’s recent scrutiny of the data brokerage industry, it would be wise for every company that collects, shares and/or uses consumer information to evaluate its business practices to avoid encountering an FTC investigation, one that could result in associated injunctive action, fines and other costs.

If you are interested in learning more about this topic or need to review your data collection, usage and/or distribution practices, please e-mail us at info@kleinmoynihan.com, or call us at (212) 246-0900.

Attorney Advertising