CalPrivacy issued the following in a press release.
The California Privacy Protection Agency Board has issued a decision requiring LocateSmarter LLC, an Iowa data broker, to pay $116,490 and change its practices after the company failed to register timely as a data broker and unlawfully required Californians to provide partial Social Security numbers before they could exercise their opt-out rights. Although the Agency has brought more than a dozen enforcement actions against data brokers, this decision is the first against a data broker under the California Consumer Privacy Act (CCPA), and the first to arise under both the CCPA and the Delete Act.
According to the decision, LocateSmarter collected personal information in part through licensing agreements, and then made this information available to its customers without timely registration as a data broker. The information included names, dates of birth, Social Security numbers, telephone numbers, email addresses, employment information, driver’s license information, bankruptcy and litigation information, and more. The information sometimes included inferences about consumer characteristics, such as whether they are “litigious.” Inferences are a protected form of personal information under California law.
LocateSmarter also allegedly required Californians to provide unnecessary data, including the last four digits of their Social Security number, before they could opt out of the company’s sales of their personal information. Requiring consumers to divulge part of their Social Security number could intimidate them and stop them from exercising their right to opt-out. Doing so also violates the CCPA’s data minimization requirements, as discussed in an earlier Enforcement Advisory on the application of data minimization to consumer requests.
“This case shows that we evaluate conduct through the lens of multiple laws to find the best fit to protect Californians,” said Michael Macko, the agency’s head of enforcement. “We did the same thing in the General Motors investigation by partnering with the Attorney General and four District Attorneys, and we will continue taking a broad look as multi-state collaboration grows.”
“The Board’s decision imposes a substantial fine even though a mere handful of consumers submitted requests to opt out, underscoring the need for businesses to take privacy rights seriously for each and every Californian,” said Tom Kemp, the agency’s executive director. “With the launch of the Delete Request and Opt-out Platform (DROP) earlier this year, Californians no longer need to hunt for data brokers on the registry and exercise their rights with each one, making it easier than ever to protect themselves.”
The Delete Act requires data brokers to register with CalPrivacy annually in January and pay a fee that funds the Data Broker Registry and DROP. DROP is a first-of-its-kind deletion mechanism that allows consumers to direct all data brokers to delete their personal information in a single request.