Data brokers: elected officials and judges.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to request that a business delete any personal information about the consumer that the business has collected from the consumer. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. Existing law requires the agency to establish an accessible deletion mechanism that, among other things, allows a consumer to request the deletion of all personal information related to that consumer through a single deletion request. Existing law requires, beginning August 1, 2026, a data broker to access the accessible deletion mechanism at least once every 45 days and, within 45 days after receiving a request, process all deletion requests and delete all personal information related to the consumers making the requests, as prescribed. Existing law requires a data broker to delete all personal information of the consumer at least once every 45 days unless the consumer requests otherwise, as prescribed. Existing law defines "data broker" to mean a business, as defined, that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship, except as provided. This bill would require the agency to obtain a list of all state and local elected officials, would require the Judicial Council to provide the agency with a list of all California judges, and would require the agency to allow elected officials or a judges to remove their information from those lists, as prescribed. The bill would require the lists to be kept confidential, as specified. The bill would also require the agency to upload the lists to the accessible deletion mechanism described above and, beginning August 1, 2026, require an entity receiving a notification that a deletion is required to do so within 5 days. This bill would authorize an elected official or judge who is on a list described above, the Attorney General, a county counsel, or a city attorney to bring an action for a violation of the bill, as prescribed. Existing constitutional provisions require that a statute that limits the right of access to the meetings of public bodies or the writings of public officials and agencies be adopted with findings demonstrating the interest protected by the limitation and the need for protecting that interest. This bill would make legislative findings to that effect.