Existing law prohibits a business from requesting medical information directly from an individual regardless of whether the information pertains to the individual, and using, sharing, or otherwise disclosing that information for direct marketing purposes unless certain requirements are met, including that it disclose that it is obtaining the information to market or advertise products, goods, or services to the individual and that it obtain consent for the information to be used or shared for that purpose, as specified.

This bill would require a business that conducts business in California, and that collects a California resident’s consumer data, to disclose to the consumer the monetary value to the business of their consumer data by posting the average monetary value to the business of a consumer’s data, including that information in its privacy policy posted on its internet website, and also including in its privacy policy disclosure of any use of a consumer’s data that is not directly or exclusively related to the service that the consumer has contracted the business to provide, as specified. The bill would also require a business that conducts business in California, that collects a California resident’s consumer data, and that sells that data, to disclose to the consumer the average price it is paid for a consumer’s data and to disclose to the consumer the actual price it was paid for a consumer’s data upon receipt of a verifiable request for that information from the consumer.

This bill would also establish the Consumer Data Privacy Commission comprised of members of academia, civil society, and industry to provide guidance to the Legislature regarding appropriate metrics and methodology for determining the value of consumer data. The bill would require the commission to report its findings to the Legislature on or before January 1, 2021.