California SB 1104

Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants to a consumer various rights with respect to personal information that is collected by a business. Existing law, the California Privacy Rights Act of 2020 (CPRA) , an initiative measure approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires a data broker to register with the agency, and defines "data broker" to mean a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. This bill would define a "direct relationship" as, among other things, when a consumer has intentionally interacted with a business for the purpose of obtaining information about, accessing, purchasing, using, or requesting the business's products or services. The bill would specify circumstances when a data broker does not have a "direct relationship," including if it sells personal information outside of a "first-party" interaction with the consumer. The bill would define a "first party" as a consumer-facing business with which the consumer intends and expects to interact. Existing law requires a data broker, in registering with the agency, to provide specified information, including, among other things, whether the data broker collects the personal information of minors or a consumer's reproductive health care data. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request that a specified data broker delete any personal information related to that consumer held by the data broker or associated service provider or contractor. This bill would require a data broker to provide additional information to the agency regarding whether the data broker sells inferences about the attributes of the consumer based on their analysis of specified data, including the personal information of minors and a consumer's reproductive health care data. Existing law establishes the Office of Data and Innovation (office) within the Government Operations Agency with a mission to deliver better government services to the people of California through technology and service innovation, data, and design. This bill would require the office to establish a privacy preference tool to enable a consumer to define and store a privacy preference profile regarding data broker data collection and use practices, among other things. The bill would require the tool to, among other things, evaluate relevant privacy, data management, and practice and policies against the consumer's preference profile. The bill would require the office to make the online tool available to other state agencies, including the agency. This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.