Data brokers: accessible deletion mechanism: deletion of personal information of elected officials and judges.

Data brokers must now access the deletion mechanism and process requests every 30 days instead of every 45 days, affecting both the initial processing deadline and the recurring deletion cycle.

The special 10-day deletion deadline for personal information of people on the uploaded lists is removed, since no lists are being created or uploaded anymore.

The entire list-based system is eliminated. Previously, the Secretary of State, local filing officers, and the Judicial Council were required to compile lists of elected officials' and judges' personal information, provide them to the CPPA, and the CPPA would upload those lists to the deletion mechanism. This is replaced with a simple notification requirement.

The State Bar of California is added as a new entity required to notify State Bar Court judges about the deletion mechanism, and must provide notification when additional State Bar Court judges are appointed.

The definition of 'judge' is expanded to include State Bar Court judges, in addition to superior court judges, appellate justices, and Supreme Court justices.

The legislative findings sections (former Sections 2 and 3) that addressed the California Constitution's requirements for limiting public access to government records are removed, since the bill no longer creates confidential lists that would trigger those constitutional provisions.

The private right of action is restructured: an elected official or judge who was notified (rather than being on a list) may bring a civil action, and the Attorney General, county counsel, or city attorney may bring an action on behalf of that official or judge. The punitive damages trigger is simplified to 'willfully violated' rather than 'willfully refused to provide for deletion.'

The bill now amends Section 1798.99.86 in addition to adding Section 1798.99.86.5, bringing the entire accessible deletion mechanism framework under this bill's scope rather than only addressing elected officials and judges.

The digest now identifies this as a state-mandated local program (changed from 'no' to 'yes'), reflecting the additional duties imposed on local government filing officers.

The required access frequency for data brokers to check the deletion mechanism is shortened from every 45 days to every 30 days, and the processing window for deletion requests is also shortened from 45 days to 30 days.

CPPA must create informational material detailing how state and local elected officials and judges can use the accessible deletion mechanism, and communicate it to the Secretary of State, filing officers, and Judicial Council. Those bodies may comply with notice requirements by providing that material directly.

Beginning January 1, 2028, and every three years thereafter, data brokers must undergo an audit by an independent third party to determine compliance with the section. Audit reports must be submitted to CPPA within five business days of a written request and retained for at least six years.

Civil actions and punitive damages provisions were narrowed to target data brokers who violate Section 1798.99.86 with respect to the personal information of a specific notified judge or elected official, rather than any violation of the section generally.

CPPA may charge data brokers an access fee when they access the deletion mechanism, not exceeding reasonable costs of providing that access. Fees are deposited in the Data Brokers' Registry Fund.

The approach for elected officials and judges changed from requiring the Secretary of State, filing officers, and Judicial Council to provide lists of personal information to CPPA, to instead notifying those individuals that they may submit their own deletion requests through the accessible deletion mechanism.

Added a definition of 'judge' for purposes of Section 1798.99.86.5: a superior court judge, appellate justice, or justice of the Supreme Court.

Removed the requirement that an elected official or judge must submit a 'threat identification letter' (police report, medical documentation, or peace officer certification) before their personal information could be deleted. Deletion is now automatic for all listed officials and judges.

Removed protection for immediate family members of elected officials and judges. The bill now only covers the officials and judges themselves.

Added a new obligation requiring local government filing officers (as defined in Government Code Section 82027) to provide lists of all local elected officials within their jurisdiction to the CPPA, including personal information. This makes the bill a state-mandated local program.

Removed the definition of 'protected information' (which included residential address, phone number, SSN, driver's license, passport, license plate, vehicle registration, and precise geolocation). The bill now uses the general term 'personal information.'

Removed the requirement for data brokers to undergo independent third-party audits every three years starting January 1, 2028, and removed the provision allowing CPPA to charge data brokers an access fee for using the deletion mechanism.

Removed amendments to Section 1798.99.86 that would have required CPPA to update the accessible deletion mechanism by January 1, 2028 to allow officials to identify themselves and submit threat identification letters, and removed the prohibition on data brokers selling or sharing new personal information of officials after initial deletion.

Changed the effective date from January 1, 2028 (for threat-based deletion) to July 1, 2027 for the entire section. Also added a specific 10-day deletion deadline for data brokers, overriding the standard 45-day processing period in Section 1798.99.86.

Added a new Section 3 with constitutional findings specific to local public bodies (required because the bill now imposes duties on local filing officers) and a new Section 4 providing for state mandates reimbursement if the Commission on State Mandates determines costs are mandated by the state.

All amendments to Government Code Sections 7928.201, 7928.205, 7928.210, 7928.215, 7928.220, 7928.225, and 7928.230 were removed. This eliminated criminal penalties for knowingly posting an elected official's protected information with intent to cause harm, restrictions on state/local agencies publicly posting officials' information, and duties on persons or businesses to remove information upon written demand.

The bill is no longer a state-mandated local program (changed from yes to no) because the provisions imposing duties on local agencies were removed. Related reimbursement provisions for state mandates were also removed.

New Civil Code Section 1798.99.86.5 requires the Secretary of State to provide the CPPA with a list of all state and local elected officials including their personal information (business and residential address, phone numbers, email addresses, full name, and other personal identifying information), updated after each certified election.

New Civil Code Section 1798.99.86.5 requires the Judicial Council to provide the CPPA with a list of all California judges, which serves as each judge's request to delete their personal information from data brokers. Judges may opt out before the list is submitted.

The CPPA must upload the lists of officials and judges to the accessible deletion mechanism established under Section 1798.99.86, and any entity receiving a notification that deletion is required must execute it within five days.

Elected officials or judges on the lists, the Attorney General, a county counsel, or a city attorney may bring a civil action for violations seeking declaratory relief, injunctive relief, reasonable attorney's fees, and actual damages. Punitive damages are available if an entity willfully refused to provide deletion.

The lists and information in them are designated as confidential and not subject to disclosure under the California Public Records Act.

Entirely new data broker deletion mechanism added under Civil Code Sections 1798.99.80 and 1798.99.86, requiring data brokers to delete protected information of threatened elected officials, judges, and their immediate family members upon verified request with a threat identification letter, effective January 1, 2028.

Government Code provisions (Sections 7928.205, 7928.210, 7928.215, and 7928.230) were broadened from protecting only home addresses and telephone numbers to covering all 'protected information' as defined (including SSN, driver's license number, passport number, license plate number, vehicle registration, and precise geolocation).

Section 7928.230 removed the limitation that prohibited conduct must occur 'on the internet,' now prohibiting soliciting, selling, or trading protected information regardless of medium.

New definitions added including 'data broker' (with exclusions for FCRA, GLBA, and Insurance Code covered entities), 'threat identification letter' (police report, medical documentation, or other reasonable verification of a threat), 'judge' (California or federal court resident in California), and 'immediate family member of an elected official or judge' (spouse, child, or dependent in same residence).

Data brokers must access the CPPA accessible deletion mechanism at least once every 45 days starting August 1, 2026, process deletion requests within 45 days, re-delete data every 45 days after initial deletion, and shall not sell or share new personal information of consumers who have requested deletion.

Beginning January 1, 2028, data brokers must undergo independent third-party audits every three years for compliance, submit audit reports to the CPPA within five business days of a written request, and maintain records for at least six years. The CPPA may charge data brokers an access fee deposited in the Data Brokers' Registry Fund.

CPPA must establish the accessible deletion mechanism by January 1, 2026; data broker access obligations begin August 1, 2026; CPPA must update the mechanism to support threat identification letters by January 1, 2028; and the mandatory deletion and no-sale/no-share obligations for threatened officials take effect January 1, 2028.

State-mandated local program designation changed from yes to no, reflecting that the new data broker obligations fall on private businesses rather than local agencies. Fiscal committee vote remains yes.

New Section 7928.201 defines 'protected information' to include residential address, telephone number, social security number, driver's license number, state ID card number, passport number, license plate number, vehicle registration information, and precise geolocation. Also defines 'publicly post,' 'publicly display,' 'sell,' and 'verifiable consumer request.'

The bill now amends six existing sections (7928.205, 7928.210, 7928.215, 7928.220, 7928.225, 7928.230) and adds one new section (7928.201), rather than amending only Section 7928.205 as introduced.

Removed the requirement that protected information be disclosed 'on the internet' in multiple provisions, broadening protections to cover all forms of public disclosure and display.

Added prohibition on selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating protected information for monetary or other valuable consideration (Section 7928.215).

Persons, businesses, or associations receiving a written demand or verifiable consumer request must remove protected information from public display within 48 hours and ensure it is not reposted on their websites. They also may not transfer the information to other parties through any medium (with an exception for telephone corporations acting under federal/state law).

Protections and rights now extend to immediate family members of an elected or appointed official who reside with the official, though they cannot enforce the section for periods when they do not reside with the official.

The written demand mechanism now also accepts a 'verifiable consumer request' as defined in the CCPA (Section 1798.140, subdivision (ak) of the Civil Code), giving officials an additional pathway to invoke protections.

Section 7928.210 criminal provision now covers 'publicly display the protected information' rather than only posting home address or telephone number, and explicitly covers the official's residing spouse or child.

State-mandated local program changed from 'no' to 'yes,' fiscal committee changed from 'no' to 'yes.' New Section 10 provides that no reimbursement is required for costs related to creating or changing a crime, but if the Commission on State Mandates finds other state-mandated costs, reimbursement shall be made.

Added Sections 8 and 9 containing legislative findings required by Article I, Section 3 of the California Constitution, stating that limiting access to personal information is necessary to protect the safety and privacy of public officials and their families.