Tech Association Says California's DROP Draft Exceeds Delete Act
California Privacy Protection Agency draft rules for making a data deletion mechanism required by the state’s Delete Act exceed the law’s scope and one requirement may be unconstitutional, the Software & Information Industry Association (SIIA) said in comments at the CPPA.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
Comments were due Tuesday (see 2504250012) on draft rules for implementing Delete Request and Opt-Out Platform (DROP).
“The proposed DROP requirements cover a much broader group of companies than are required to register under the Delete Act,” said SIIA. “The California Delete Act only requires registration as a data broker by businesses that knowingly collect and sell the personal information of a resident with whom it does not have a direct relationship.”
However, the draft rules say that, for a consumer and a business to have a direct relationship, “not only must a business collect personal information directly from a consumer, but that consumer must ‘intend to interact with the business,’” said SIIA. “This expansion goes well beyond the plain language of the Delete Act, which specifically carves out the collection of data in the context of a direct relationship.”
“It is rarely clear whether a consumer making an online purchase intends to, for example, interact with cookies, or reveal geolocation information,” the trade group added. “In fact, the same is often true of a variety of information collected from a consumer pursuant to that consumer’s interaction with a business.”
Additionally, SIIA raised concerns about requiring data brokers to delete inferences based on information they collected. That proposed requirement isn’t in the Delete Act and may be unconstitutional under the First Amendment, it said.