Data brokers: sale of personal information.

Existing law protects the privacy of personal information, including customer records, and requires a business that owns or licenses personal information about a California resident to implement and maintain reasonable security procedures and practices appropriate to the nature of the information, in order to protect the personal information from unauthorized access, destruction, use, modification, or disclosure. Existing law requires an operator of a commercial Internet Web site or online service that collects personally identifiable information through the Internet about consumers residing in California who use or visit its commercial Internet Web site or online service to conspicuously post its privacy policy on its Internet Web site or online service and to comply with that policy. Unless required or authorized by federal or state law to share the personal information with a 3rd party or prohibited by federal or state law from providing access to the personal information, this bill would require a data broker, as defined, that sells or offers for sale to a 3rd party the personal information of any resident of California, to (1) permit a subject individual, as defined, to review his or her personal information and (2) conspicuously post an opt-out notice on its Internet Web site that would include specific and easily understood instructions for the subject individual to make a demand on the data broker's Internet Web site that his or her personal information not be shared with or sold to a 3rd party. The bill would require a data broker that receives a demand from a subject individual pursuant to these provisions to cease sharing or selling that information with a 3rd party as soon as is reasonably possible, and thereafter to only retain as much personal information as is reasonably necessary to comply with the subject individual's demand. This bill would also make it unlawful for a data broker to solicit or accept the payment of a fee or other consideration to review or permanently remove personal information from the data broker's database. The bill would authorize a subject individual to bring a civil action against any person in violation of these provisions for specified damages.