Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Data Privacy Drop Regulations topic
No spam. Unsubscribe anytime.
Privacy lawyer urges cure period and narrower data-broker scope for California DROP rules
Summary
At a June 10 public comment session, Ben Isaacson of In House Privacy Inc. urged the California Privacy Protection Agency to add a cure period for DROP-initiated delete actions, exempt intermediaries like marketing agencies and SaaS platforms from data-broker registration, clarify how affirmative consent interacts with DROP, and simplify technical requirements for small businesses.
Ben Isaacson, principal at In House Privacy Inc., urged the California Privacy Protection Agency on June 10 to revise its proposed DROP (delete request and opt-out platform) regulations to reduce compliance risk for businesses and avoid unintended penalties for good-faith actors.
Isaacson told the agency that, because of "the statutory penalties inherent in s p 3 62 delete act," the regulations should "include a cure period or at least a warning system" during early implementation to allow firms to correct erroneous DROP applications. He said such a safety valve is important so "companies ... operating in good faith" are not hit immediately with statutory penalties for implementation errors.
Isaacson also asked the agency to narrow the definition of "data broker" to exclude intermediaries that provide services to data brokers, citing "advertising and marketing agencies, and software as a service platforms" as examples that should be exempt from registration and participation in DROP. He said these intermediaries often act under service-provider agreements and do not function as primary data brokers.
On consumer consent, Isaacson raised a scenario in which a consumer who registers with DROP later gives affirmative consent—for example, by entering a sweepstakes—to have data sold. He asked the agency to clarify whether such later consent would override the consumer's DROP registration, saying current language creates uncertainty about whether a data broker could rely on affirmative consent captured after a DROP registration.
Finally, Isaacson urged the agency to account for small businesses on the data-broker registry that "don't necessarily maintain databases in the traditional sense," arguing the proposed technical requirements assume a level of data infrastructure that some small registrants do not have. He recommended simplifying how DROP is applied to lists and small-scale operations rather than forcing all registrants to build complex data-hygiene systems.
The agency reminded commenters that written submissions are due by 5 p.m. today and that oral and written comments will be treated equally and addressed in the agency's final statement of reasons later in the rulemaking process. No formal responses were made during the hearing; staff said they will consider public comments and may propose amendments to the draft text.
