Law / United States / 
California
Delete Act: independent audit of data broker deletion compliance every three years
Also known as Delete Act.
Cal. Civ. Code section 1798.99.86(e)
A data subject rights rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Governance, Retention
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Produced on request, Kept
As of .
What it requires
- If you are a data broker, beginning and every three years after, have an independent third party audit your compliance with the deletion duties of Civil Code section 1798.99.86.
- Submit the audit report and any related materials to the California Privacy Protection Agency within five business days of its written request, and keep them for at least six years.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, in an administrative action under Civil Code section 1798.99.82(d), which makes a data broker that fails to comply with section 1798.99.86 liable for the Agency's reasonable expenses. The title creates no private right of action.
What this law does
Beginning , and every three years after, a data broker must undergo an audit by an independent third party to determine its compliance with section 1798.99.86, the deletion duties. The data broker must submit the report resulting from the audit, and any related materials, to the California Privacy Protection Agency within five business days of the Agency's written request, and keep them for at least six years.
Beginning , the data broker's annual registration must say whether it has undergone the audit and, if so, the most recent year it submitted the report to the Agency. A data broker that fails to comply with section 1798.99.86 is liable in an administrative action by the Agency for the Agency's reasonable expenses of investigation and administration.
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.