/>i
California’s privacy watchdog, CalPrivacy, fined a data broker $116,490 over an allegedly complicated opt-out-of-sale process. The regulator emphasized that it was the first time it used both the CCPA and the Delete Act in the same case.
The company, LocateSmarter, LLC, is based in Iowa and its customers include those that need location and identity verification services. CalPrivacy noted that the company sold a wide variety of information to its customers. These elements included Social Security numbers and job history. Also sold were driver's license details, and bankruptcy and lawsuit records.
With respect to the Delete Act violations, according to CalPrivacy, the company collects and sold personal information, making it a data broker for purposes of the law, but did not register as a data broker before the required deadline. The company has agreed to register with the state.
CalPrivacy’s settlement was also based on a CCPA violation: that the company asked individuals too much information before they could opt out. The information requested include name, address, and the last four digits of their Social Security number. This violated CCPA data minimization principles. The company has agreed to modify its opt out process to include minimal steps and be easier for people to do.
Putting It into Practice: This case is a reminder that CalPrivacy is looking closely at companies that sell personal data. We expect to see more entities register with the state as a result of this settlement. For those who are not data brokers, keep in mind potential downstream obligations when receiving information from brokers. This includes developments we wrote about in New Jersey. And, as always, check your opt-out processes to assess if they comply with data minimization principles.
