Law / United States / 
California
Data Broker DROP Regulations: processing and reporting deletion requests (article 3)
Also known as DROP.
Cal. Code Regs. tit. 11, sections 7610 to 7616
In force since .
A data brokers rule binding private bodies.
- Obligation class
- Data subject rights, Reporting, Security
As of .
What it requires
- If you are a data broker, create a DROP account before you first access the DROP, keep its credentials confidential and restricted to authorized persons, and tell the Agency immediately in writing of any unauthorized use of the account or breach of security related to the DROP (section 7610(a)(1)).
- If you begin operating as a data broker after the registration period, create a DROP account before operating, begin accessing the DROP within 45 calendar days of commencing operation, and pay the first-time access fee unless you have already paid a registration fee that year (section 7611(a)).
- Select every consumer deletion list whose identifiers match personal information in your records, and keep the selection current (section 7610(a)(3)).
- Access the DROP and download your selected consumer deletion lists at least once every 45 calendar days, manually if automated access fails (section 7612).
- Standardize your records as section 7613(a)(1) prescribes, hash them with the algorithm the deletion list uses, compare, and delete all personal information associated with each matched identifier, including inferences drawn from information collected from third parties, except what the statute exempts or you collected directly from the consumer as a first party (section 7613(a) and (b)).
- Keep a deletion request that matches nothing and compare newly collected records against it before you sell or share new personal information, and direct your service providers and contractors to delete matched information (section 7613(c) and (d)).
- At each access session report the status of every deletion request received in the previous session, with one of the response codes section 7614(b) lists (section 7614).
- Use the personal information the Agency provides only to comply with the Delete Act, never sell or share it, protect it with reasonable security procedures and practices, and do not contact a consumer to verify a DROP request (section 7616).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Civil Code section 1798.99.82(d): a data broker that fails to comply with section 1798.99.86 is liable for an administrative fine of $200 for each deletion request for each day it fails to delete as that section requires, plus the Agency's reasonable expenses of investigation and administration.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 200
Who enforces it
Enforcement body
California Privacy Protection Agency, in an administrative action under Civil Code section 1798.99.82(d).
What this law does
Article 3 of the Data Broker Registration and Accessible Deletion Mechanism Regulations concerns the Delete Request and Opt-out Platform requirements, beginning with account creation in section 7610. Section 7612(a) of the Data Broker Registration and Accessible Deletion Mechanism Regulations requires a data broker to access the DROP to download its selected consumer deletion lists at least once every 45 calendar days.
Under section 7613(a)(2) of the Regulations, a data broker must delete all personal information associated with the matched identifier for every match between a consumer deletion list and its own records. For deletion requests that match nothing in its records, a data broker must save and maintain the consumer deletion list for the sole purpose of complying with section 1798.99.86(d) of the Civil Code by comparing newly collected records with deletion lists.
Section 7614(a) of the Regulations requires a data broker to report the status of every deletion request, using a response code, at each subsequent access session. Section 7616(a) of the Regulations lets a data broker use consumer personal information provided by the Agency only to comply with section 1798.99.86 of the Civil Code, and bars selling or sharing it.
Section 7616(c) of the Regulations bars a data broker from contacting a consumer to verify a deletion request submitted through the DROP. Section 7611(a)(2) of the Regulations requires a business that begins operating as a data broker after the registration period to begin accessing the DROP within 45 calendar days of commencing operation. The Agency's page on the accessible deletion mechanism carries an effective date of .
When LexLint raises it
When your app profile says your app crawls the web or tracks devices.