Schedule a Consultation: 858.483.9200

Is Your San Diego Business a “Data Broker” and Will You Need to Register?

Data and data privacy continue to be high priorities for California lawmakers. One of the new laws recently passed by the California State Assembly is a data broker registration law. The particular law is Assembly Bill 1202. See text of AB 1202 here. AB 1202 requires any business that collects and “sells” consumer personal data and information must register themselves as “data brokers” with the California Attorney General. Filing a form is required along with a registration fee and the information must be updated annually. The new statute defines a “data broker” as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship.” Certain exceptions are provided in the statute including exceptions for consumer reporting agencies and certain financial institutions. A registry is to be created by the Attorney General’s Office listing the Data Brokers and the registry is to be made available to the public.

“No problem,” you might say because your business does not “sell” consumer data. However, the definition of “sell” in AB 1202 is linked to the definition of “sell” set forth in the California Consumer Privacy Act (“CCPA”). Under the CCPA, “to sell” is very broadly defined to include any type of disclosure in exchange for any sort of value or consideration. In other words, sharing of data and information is considered “selling” where the sharing party receives some sort of benefit. Money need not change hands for a “benefit” to be conferred.

This creates the possibility that sharing data will be considered “selling” data under the newly enacted AB 1202. Under those circumstances, your San Diego business might meet the definition of “data broker” and might need to register. You might avoid needing to register if you can demonstrate that your business has a “personal relationship” with all of your consumers. AB 1202 does not define “personal relationship” but likely included in that definition will be subscribers, registered users, employees, contractors, investors, donors and others. An experienced San Diego corporate attorney can provide advice and counsel on these points.

If your business meets the definition of “data broker” and you fail to register with the Attorney General’s Office, your business would be subject to civil penalties, costs, and injunctive relief in proceedings filed by the Attorney General. Penalties are statutory fines of $100 per day that the business failed to register as required. The Attorney General is also permitted to seek reimbursement of expenses related to investigating and prosecuting a violation of the law.

Call San Diego Corporate Law Today

For more information, call corporate attorney Michael Leonard, Esq., of San Diego Corporate Law. Mr. Leonard provides legal services related to business law, private securities offerings/sales, the sale/purchase of a business, and for mergers and acquisitions. Mr. Leonard can also assist with setting up a new corporate entity, annual corporate maintenance, and can help review and draft business contracts. Mr. Leonard can be reached at (858) 483-9200 or via email. Like us on Facebook.