Calif. passes law limiting how tech companies sell users’ personal data

Calif. passes law limiting how tech companies sell users' personal data

June 28 (UPI) — California Gov. Jerry Brown on Thursday signed a sweeping data privacy law that allows Californians to prohibit the sale of their personal data to third parties by tech companies.

The law also broadens the definition of what is considered personal, adding extra protections to consumers who are concerned about their privacy rights.

California Assembly Speaker Anthony Rendon said the bill was “the most robust set of Internet privacy protections in the nation.”

“A constitutional right to privacy is unique to California and has served as the basis for many groundbreaking privacy laws enacted over the years. Today, we continue that tradition,” Rendon said.

And Ashkan Soltani, a digital researcher and former chief technologist for the Federal Trade Commission, told The Wall Street Journal the regulations are the first of their kind in the United States.

The bill was created in response to how tech giants like Google and Facebook scoop up vast amounts of personal data on users and sell them to third parties. Facebook CEO Mark Zuckerberg was recently called to testify before Congress to explain how users’ personal data were sold to Cambridge Analytica, a political consulting firm, without their consent, bringing more national attention to the matter. But it applies to smaller companies, as well.

According to the bill’s language, it will “grant a consumer a right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer, the categories of sources from which that information is collected, the business purposes for collecting or selling the information and the categories of third parties with which the information is shared.”

In addition, it requires businesses to make disclosures about the information and the purposes for which it is used; require businesses to delete a user’s data when requested; disclose which businesses their data was sold to; and prohibit businesses from collecting personal data from people under the age of 16.

The bill also broadens the definition of “personal information” to include a list of “characteristics and behaviors, personal and commercial, as well as inferences drawn from this information.”

The bill doesn’t go into effect until 2020 and tech giants most affected by it, such as Google and Facebook, are expected to fight for amendments to the bill to decrease the scope of restrictions.

But the bill is also expected to inspire similar legislation in other states and potentially on the federal level.