California SB 362 Passes Assembly and State Senate by Wide Margins; On to Governor Newsom
[Update October 2023: the California Delete Act aka SB 362 was signed into law on October 10, 2023 by Governor Newsom. My analysis of the law can be found here.]
On September 13, 2023, California Senate Bill 362 passed the State Assembly 52-14. It needed 41 votes to pass, so it passed very comfortably. The bill even gained bipartisan support, with one Republican Assembly member joining the supporting coalition and voting yes. After the bill passed the Assembly, it went back to the State Senate to accept the various amendments made in the Assembly (referred to as “concurrence”). On September 14, 2023, SB 362 passed the Senate 31-9. It needed 21 votes to pass. The 31 votes represent over 75% support of the State Senate, which matches the 80% support of California consumers surveyed. It is hard to deny that this bill is not very popular with both legislatures and consumers in light that 91% of Californians registered concerns regarding the collection and sale of personal data by data brokers (based on the same survey).
Prior to the Assembly vote, California Attorney General Rob Bonta came out in support of the bill. I think this quote from that support letter [which I can’t find an online link to, sorry] does a nice job of summarizing that the bill "[would] allow a consumer to make a single secure and verifiable request that data brokers which maintain personal information about the consumer proceed to delete that information—and to continue to delete personal information received about them in perpetuity." Couple of key points that AG Bonta makes here. First, SB 362 offers consumers the deletion requests via a single request, versus having to make 500 requests to the 500 data brokers registered with the State. Second, SB 362 involves personal information “about” the consumer. Existing California law says a delete request only applies to data collected “from” the consumer. Because data brokers don’t collect data directly from consumers, that was a big weak spot in existing law in that data brokers could say we don’t have to delete anything as never got data from you. Third, SB 362’s consumer request is in perpetuity (unless the consumer changes their mind), whereas the current model is set up so that data brokers could simply repopulate their data on consumers (e.g., buying it from another data broker), and the consumer is forced to go back and request deletion constantly.
This table summarizes deletion under SB 362 versus CCPA:
To become actual law that bill needs to be signed by Governor Newsom, and he has until October 14, 2023, to either sign it or veto it. In theory, the fact that the bill further protects reproductive rights should be appealing to him given his strong pro-choice stance, as it is clear red states are aiming to acquire or subpoena location data from data brokers to track people getting abortions (e.g. the Alabama attorney general says he has the right to prosecute people who facilitate travel for out-of-state abortions and Texas towns are saying it is illegal to facilitate an abortion when driving on their roads). Plus there has been increased usage of “people search” data brokers to dox abortion providers. Of course, there will be other points about the bill that would appeal to him beyond this topic, but at this juncture, one can only guess what the Governor will decide to do with this and the 700+ other votes that he now has sitting on his desk.