California shuts down data broker for failing to register
The California Privacy Protection Agency (CPPA) on Thursday announced that a data broker must shut down its business for three years for failing to comply with the state’s Delete Act, which requires certain brokers to register with the state.
The requirement that the company, Background Alert, close its doors for failing to register is unprecedented. Background Alert, which is based in California, agreed to the settlement terms.
Background Alert relies on billions of public records to develop and sell individual profiles over its website, drawing inferences about them to identify people who “may somehow be associated with” the individual being searched, the CPPA said, quoting Background Alert.
The company’s marketing materials say “it's scary how much information you can dig up on someone.”
It also advertises that it looks for “alarming patterns” to make inferences, which the CPPA says are especially invasive.
Background Alert did not respond to a request for comment.
“Seemingly innocuous data points, when combined with other data points, can be exploited to infer highly personal characteristics about people,” CPPA said in its order settling the case. “Consumers can be identified, re-identified, and profiled as a result.”
Inferences can be used unscrupulously to identify immigrants, veterans and patients at reproductive health clinics, CPPA said.
The state has recently been cracking down on data brokers who don’t register.
The Delete Act requires data brokers to register with the state annually and pay a fee. Those fees are funding the construction of a tool consumers can use to compel all brokers to delete their personal data with the push of a button, according to the CPPA.
"California, along with states like Texas, has been at the leading edge of reining in the data brokerage industry and tackling its myriad harms to people's privacy, safety, and security,” said Justin Sherman, a data broker expert and scholar in residence at the Electronic Privacy Information Center.
Suzanne Smalley
is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.