What some states are doing to improve privacy for your personal data

John Yang:

You may not be aware of it. But right now there are companies out there making money off of your personal data, data that you likely never agreed to share like real time location, spending habits and private financial information.

These data brokers say the information allows service providers to make our lives easier by personalizing their products. But privacy advocates say it's collected from our devices, smartphones and wearables like Fitbits without our permission, and that once collected, it isn't properly secured.

With no one single all-encompassing federal law regulating data brokers, more and more state legislatures are acting. 13 states now have comprehensive data privacy laws, in effect or soon to take effect.

Earlier this month, California Governor Gavin Newsom signed a bill called the Delete Act that consumer protection advocates say is a groundbreaking advance in privacy rights.

Emory Roane is Policy Counsel for Privacy Rights Clearinghouse, which advised California lawmakers on the bill Emery will tell us what the Delete Act does and why it's considered such a big advance by privacy advocates?

Emory Roane, Privacy Rights Clearinghouse:

Right. So these consumer privacy laws that are coming online, are almost all following the California model, which though there are some variations are based around the idea that you can go to a business and say, hey, tell me what information you have about me, please don't share that information and maybe delete that information if I want you to delete it, and businesses have to comply with that.

But what about this hundreds or thousands of businesses out there that are buying and selling your information that you've never heard of, if you wanted to exercise your consumer rights against these businesses, you have to one know that they exist, which is difficult already, then you're faced with an actual monumental task of exercising your rights.

So you go to this registry, and there's 600 registered brokers in California right now, then you initiate your California Consumer Privacy Act request, which can take up to 90 days to fulfill for every single broker on that list.

And then of course, once you exercise your privacy rights, there's nothing to stop that broker from turning around and then immediately collecting your information again and selling it from some other third party.

So the Delete Act recognizes that this is the framework we have and tries to imagine what would be required for a consumer to be able to effectively exercise that deletion right with data brokers. What that looks like, is that it takes the existing requirements in California that data brokers registered with the Attorney General, and it for one, it moves that registration requirement to the California Privacy Protection Agency, as opposed the Attorney General's office a dedicated privacy Enforcer.

But most importantly, it requires the agency to and by 2026, at least create a mechanism that will allow any of us to go to the agency's website, and in a few minutes for free for anyone with disabilities require that every single broker that's on that list, delete all of your personal information. They have to delete their information every 45 days and then have to stop selling, you're sharing your information for all of time into the future until you decide otherwise.

John Yang:

And what's the enforcement mechanism? If you don't know these companies exist? How can anyone tell whether they really have deleted this information?

Emory Roane:

That's a great point. Any law and especially privacy laws are only as good as the enforcement mechanisms. So the California Consumer Privacy Act last year, created the new California Privacy Protection Agency, the only dedicated privacy protection agency in the country. So they're going to have the ability to go into data brokers and make sure that they're deleting information when they're required to delete and make sure they're registering when they're required to register.

Additionally, the Delete Act doubles the fines for non-registration increases the amount of information that brokers have to provide every year when they register with the agency. And it also includes auditing requirements.

John Yang:

The head of the trade group of data brokers, obviously they oppose this bill. And they say that one of the things is this is going to give a big boost to big platforms like Google and Meta who collect a lot of information but don't sell it so they're not touched by this What do you say to that.

Emory Roane:

Frankly, the California Consumer Privacy Act already exists. And it works fairly well when it comes to businesses that have a direct relationship with you. And you can go to those businesses and you can exercise your CCPA rights without the fear that they're going to turn around and immediately start collecting your information from some other third party and selling it after the fact. That's simply not the case with data brokers.

John Yang:

This summer, the head of the consumer protection finance bureau said they were going to start rulemaking on data brokers. But given the nature of federal law right now, what can they actually do?

Emory Roane:

There's reasons to be optimistic about the CFPB's rulemaking on data brokers, it's certainly long overdue, and it's desperately needed. To be clear, you know, federal policy work is in a really tough place right now. It's California, other states are demonstrating the goals of federalism by innovating in legislature when able to get bills actually over the governor's desk signed into law, we've faced tougher barriers, let's say federally.

John Yang:

The California law doesn't take effect until 2026. For people who don't live in California, who don't live in one of the states with a comprehensive data privacy law, what advice do you give them? How can they protect themselves?

Emory Roane:

Unfortunately, data brokers are an area where consumers have very little control. There are some private services you can use out there that attempt to, frankly, do what the Delete Act promises. There are consumer privacy services that will allow you to pay them to repeatedly send deletion requests or opt out requests to data brokers.

But there are some fundamental limitations that would really limit how effective that those sort of delete services can be. So unfortunately, as you know, with everything there is still a need for legislative and regulatory solution. There's precious little that consumers can do to avoid the reach of data brokers right now.

John Yang:

Emory Roane of Privacy Rights Clearinghouse Thank you very much.

Emory Roane:

Thank you.