Recent data breaches have exposed Social Security numbers of millions of Americans for sale on the dark web. Fraudsters gain access using credit cards, leading to severe consequences.
Stolen Social Security numbers enable thieves to open new credit cards, file fraudulent tax returns, and steal government benefits and medical care aid.
California’s Response: The Delete Act
In California, legislation called the Delete Act (SB 362) aims to safeguard privacy. It allows residents to erase personal data from registered data brokers via a centralized platform known as DROP, which stands for Delete Request and Opt-out Platform.
Data to be deleted includes Social Security numbers, precise geolocation, browsing history, email addresses, phone numbers, health-related information, among others. Exempted data includes first-party data, publicly available data, and others.
Brokers must register with the California Privacy Protection Agency (CPPA). They are required to delete and not sell any data collected in the future. A first round of deletions begins after August 1, with a 45-day deadline to comply.
Non-compliance results in a $200 daily penalty for each individual whose information should have been erased.
Data Deletion: Growing Requests
By July 1, over 332,000 Californians requested data deletion. Among nearly 600 brokers registered, various brokers sell different types of data, including precise locations, identity data, gender identity, reproductive health, and more.
A significant number of brokers sell data to federal and state governments, police agencies, foreign entities, and AI developers.
Limited Engagement: A Call to Action
Californians requesting data deletion are less than 1% of the population. Increasing participation is crucial to reduce risks associated with sensitive information.
Tom Kemp, Executive Director of CalPrivacy, urges residents to engage in data deletion. Benefits include reduced targeted advertising, fewer scams, and decreased potential for fraud.
Residents can apply for deletion on DROP’s platform by August 1.
Nationwide Efforts
The lack of comprehensive federal regulation on data brokers presents a fragmented landscape. Twenty states have enacted privacy laws. States like Connecticut, New Jersey, Oregon, Texas, and Vermont have taken steps but vary in scope and enforcement.
Connecticut will require brokers to register with the Department of Consumer Protection by July 2028, following a similar deletion mechanism as California. New Jersey’s recent bill also targets data brokers and bans selling sensitive data.
Efforts in other states continue to develop, demonstrating a growing recognition of privacy protection needs.
Leave a Reply