Privacy: data brokers.

Existing law, the California Consumer Privacy Act of 2018 (CCPA) , grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, and also establishes, as approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, the California Privacy Protection Agency and vests it with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The California Constitution grants a right of privacy. Existing law requires data brokers to register with, and provide certain information to, the Attorney General. Existing law defines a data broker as a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, subject to specified exceptions. Existing law subjects data brokers that fail to register to injunction and liability for civil penalties, fees, and costs in an action brought by the Attorney General, with any recovery to be deposited in the Consumer Privacy Fund, as specified. Existing law imposes a $100 civil penalty for each day a data broker fails to register. This bill would include in the definition of data broker a business that knowingly collects and shares, as defined, certain personal information to third parties. The bill would transfer all authority and responsibilities under the provisions relating to data broker registration from the Attorney General to the CCPA, including by requiring data brokers to annually register with the CPPA on or before January 31. However, the bill would authorize the Attorney General to also bring an action against a data broker that fails to register. The bill would require data brokers to provide additional information to the CPPA during the registration process would increase the civil penalty for failing to register to $200 for each day the data broker fails to register. The bill would require the CPPA to adopt regulations in compliance with the Administrative Procedure Act. The bill would also make other technical changes.