Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Privacy topic
No spam. Unsubscribe anytime.
Privacy agency requests funds to build data-broker deletion platform; LAO asks for interagency agreement
Summary
The California Privacy Protection Agency requested fund authority and two positions to build the Delete Request and Opt Out Platform (DROP) implementing the Delete Act's data-broker deletion requirements; the LAO recommended the subcommittee review the interagency agreement with CDT.
The California Privacy Protection Agency asked the Assembly Budget Subcommittee No. 5 for expenditure authority to build an accessible deletion mechanism for consumers to request deletion of personal information maintained by registered data brokers, as required by the Delete Act of 2023.
What the agency requested - Vaughn Chitambira, deputy director of administration at the CPPA, said the agency is building the Delete Request and Opt Out Platform (DROP) in partnership with the California Department of Technology (CDT). The CPPA requested $2.4 million from the Data Broker Registry Fund in 2025-26 and $2.3 million in 2026-27, plus two positions phased in over two years, to meet Delete Act obligations and build the platform.
Scope and governance - CPPA said CDT's Office of Digital Services will provide direct technology development under an interagency agreement (IAA). CPPA explained that the DROP project was delegated back to CPPA through the project approval lifecycle (POL/PAL) in January 2025 and that CPPA, as the delegated project owner, will oversee governance and risk management, while CDT provides development resources. - CPPA emphasized that the arrangement includes an IAA and a memorandum of understanding with the CDT project management office to preserve segregation of duties and oversight.
LAO and oversight concerns - Brian Metzger of the Legislative Analyst's Office said the project and the CDT-CPPA arrangement are "fairly unique" and recommended the subcommittee request the interagency agreement to inform oversight and budgeting decisions.
Public comment - Several small-business and chamber representatives spoke about AI and CPPA rulemakings generally, urging the agency to consider compliance burdens on small businesses and to redraft certain automated decision-making regulations. CPPA said it had received extensive public comment and would consider changes at an upcoming board meeting.
What the subcommittee decided: The agency presented the request; no appropriation vote or final action was recorded at the hearing.
Context: The Delete Act transferred the data-broker registry to CPPA and requires an accessible deletion mechanism effective Jan. 1, 2026; CPPA said the IAA with CDT is needed because the agency is small and required to meet statutory timelines.
