Data Broker Registration

Civil Code Division 3, Part 4, Title 1.81.48 deals with data broker registration.

Section 1798.99.80 provides definitions for the terms “authorized agent” and “data broker,”

Section 1798.99.81 created the “Data Brokers’ Registry Fund” within the State Treasury. The fund is administered by the California Privacy Protection Agency. All moneys collected or received by the CPPA and the DOJ under this title are to be deposited into the Data Brokers’ Registry Fund, to be available for expenditure by the CPPA, upon appropriation by the Legislature, to offset all of the specified costs.

Section 1798.99.82 states that, on or before January 31 following each year in which a business meets the definition of data broker as provided in this title, the business is required to register with the CPPA pursuant to the requirements of this section. In registering with the CPPA, a data broker is required to all of the specified items.

A data broker that fails to register as required by this section is liable for administrative fines and costs in an administrative action brought by the CPPA as specified. A data broker required to register under this title that fails to comply with the requirements of law is liable for administrative fines and costs in an administrative action brought by the CPPA as specified.

The terms “foreign actor,” “foreign adversary country,” “developer of a GenAI system,” and “generative artificial intelligence system.”

Section 1798.99.84 requires the CPPA to create a page on its internet website where the registration information provided by data brokers and the accessible deletion mechanism is to be accessible to the public. Information provided by a data broker cannot be made accessible to the public on the CPPA’s internet website.

Section 1798.99.85 provides that, on or before July 1 following each calendar year in which a business meets the definition of a data broker as provided in this title, the business is required to take three specified actions. The accessible deletion mechanism established is required to meet all of the ten specified requirements.

Section 1798.99.88 provides that nothing in this title is to be construed to supersede or interfere with the operation of the California Consumer Privacy Act of 2018.

Section 1798.99.89 specifies that no administrative action brought pursuant to this title alleging a violation of any of the provisions of this title must be commenced more than five years after the date on which the violation occurred.