October 2023 in Brief: Internet Law & Cyber-Security

California Expands Privacy Laws

By Jessica Varda, J.D. Candidate, Class of 2026, Louis D. Brandeis School of Law at the University of Louisville

On October 10, 2023, Governor Gavin Newsom signed the California Delete Act, also known as S.B. 362, adding to California’s privacy laws and its Data Broker Registration Law (DBRL). The new law requires the California Privacy Protection Agency (CPPA) to establish an “accessible deletion mechanism,” allowing consumers to make one single, free of charge request for deletion of any personal information from any data brokers who have the information, by January 1, 2026.

Here are the key features of the California law:

• The law provides consumers the “right to delete” information collected by data brokers, and to prevent data brokers from collection of consumers’ personal information in the future.
  • The law incorporates the definition of a “data broker” established by the California Consumer Privacy Act (CCPA) as “a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship,” not including entities to the extent they are covered by the following, as expanded upon by the DBRL: 1) the Fair Credit Reporting Act (15 U.S.C. Sec. 1681 et seq.), 2) the Gramm-Leach-Bliley Act (Public Law 106-102), or 3) the Insurance Information and Privacy Protection Act (Article 6.6 (commencing with Section 791) of Chapter 1 of Part 2 of Division 1 of the Insurance Code).
  • Beginning August 1, 2026, a data broker shall access the mechanism at least once every forty-five days to process requests.
  • Beginning January 1, 2028, a data broker shall undergo an audit every three years to determine compliance.
• The law adds the requirement for data brokers in their annual registration to provide whether they collect information on: 1) the personal information of minors, 2) consumers’ precise geolocation, and 3) consumers’ reproductive health data.
  • The law also adds a requirement for a data broker to include a link to a page on its website that details how consumers may exercise their privacy rights and does not make use of any dark patterns.
  • Beginning January 1, 2029, data brokers must also provide information on whether they have undergone an audit as described in the new law (see §1798.99.86(e)).
• Enforcement
  • The law transfers all of the relevant duties of the attorney general in the DBRL to the CPPA, authorizes the CPPA to bring administrative actions against data brokers in violation of the law, changes the penalty from civil to administrative, and increases the applicable fine from $100 to $200 for each deletion request for each day the date broker fails to delete information as required.

The Digital Financial Assets Law: California’s Virtual Currency Licensing, Regulation, and Financial Framework

By DaJonna Richardson, J.D. Candidate, Class of 2024, University of Colorado Law School

On October 13, 2023, Governor Gavin Newsom signed Assembly Bill 39, establishing a Digital Financial Assets Law (DFAL) in the state of California. The new law, taking effect July 1, 2025, will authorize the Department of Financial Protection and Innovation (DFPI) to create a robust regulatory framework, including licensure and enforcement authority, for certain crypto activities. California’s Department of Financial Protection and Innovation (DFPI) has gone through several name changes since 1913.

This bill will become operative only if another bill, Senate Bill 401, is enacted and takes effect on or before January 1, 2024. This second bill applies to “digital financial asset transaction kiosks,” which are “capable of accepting or dispensing cash in exchange for a digital financial asset.”

California is the second state in the country to begin regulating virtual currency. Currently, New York requires entities conducting virtual currency business activity in New York to obtain a “BitLicense” (or a charter under the New York Banking Law).

Key Points

Licensure Requirements

• Before an agent submits a license application to the DFPI, an applicant conducting a “digital financial asset business activity” with or on behalf of a California resident must “create and, during licensure, maintain in a record policies and procedures for, among other things, an information security program and an operational security program,” as described in the legislative counsel’s digest for the bill.
• The bill defines “Digital financial asset business activity” as
  • (1) Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
    • Digital financial assets are defined as a digital representation of value used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender.
  • (2) Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
  • (3) Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games.

Exemptions

The following entities are exempt from DFAL, among others:

• The United States, a state, political subdivision of a state, agency, or instrumentality of federal, state, or local government, or a foreign government or a subdivision, department, agency, or instrumentality of a foreign government.
• Certain banks.
• Certain trust companies.
• Certain federally chartered or state-chartered credit unions with an office in California.
• Persons that provide processing, clearing or settlement services solely for transactions between or among persons that are exempt from the licensing requirements.
• Persons using a digital financial asset, or obtaining a digital financial asset as payment, solely for personal, family or household purposes, or academic purposes.
• A merchant that accepts a digital financial asset as payment for the purchase or sale of goods or services, which does not include digital financial assets.
• Persons whose digital financial asset business activity with, or on behalf of, California residents is reasonably expected to be valued, in the aggregate, on an annual basis at $50,000 or less.
• Persons that contribute only connectivity software or computing power to securing a network that records digital financial asset transactions or to a protocol governing the transfer of the digital representation of value.

Conditional Licensure

For applicant holders of a New York state license, the commissioner of California’s DFPI “may issue a conditional license to an applicant who holds or maintains a license to conduct virtual currency business activity in the state of New York pursuant to Part 200 of Title 23 of the New York Code of Rules and Regulations or a charter as a New York State limited purpose trust company with approval to conduct a virtual currency business under New York law, provided the license was issued or approved no later than January 1, 2023, and the applicant pays all appropriate fees and complies with the requirements of this division.”

License Maintenance

• A licensee shall maintain a surety bond or trust account in United States dollars in a form and amount as determined by the Department of Financial Protection and Innovation for the protection of residents that engage in digital financial asset business activity with the licensee.
• A licensee shall maintain at all times capital and liquidity in an amount and form as the department determines is sufficient to ensure the financial integrity of the licensee and its ongoing operations based on an assessment of the specific risks applicable to the licensee.
• A licensee shall hold liquid assets required to be maintained in accordance with this section in the form of cash, digital financial assets other than digital financial assets over which it has control for a resident entitled to the protections of Section 3503, or high-quality, liquid assets as defined in subdivision (a) of Section 249.20 of Title 12 of the Code of Federal Regulations in proportions determined by the department.
• The DFPI may examine the business in order to ascertain whether the business is being conducted in a lawful manner and whether all digital financial asset business activity is properly accounted for. A licensee shall pay the reasonable and necessary costs of an examination under this section to the commissioner. The commissioner of the DFPI may maintain an action to recover the cost in any court of competent jurisdiction.
• A licensee shall maintain, for all digital financial asset business activity with, or on behalf of, a resident for five years after the date of the activity, a record of all of the following:
  • (1) Any transaction of the licensee with, or on behalf of, the resident or for the licensee’s account in this state, including all of the following:
    • (A) The identity of the resident.
    • (B) The form of the transaction.
    • (C) The amount, date, and payment instructions given by the resident.
    • (D) The account number, name, and United States Postal Service mailing address of the resident and, to the extent feasible, other parties to the transaction.

The bill provides companies with an eighteen-month preparation period to ensure the adopted regulatory framework can be thoughtfully tailored to address industry trends and mitigate consumer harm. California continues to lead the nation in artificial intelligence, digital finance law, and data regulation. With a watchful eye, the cryptocurrency industry will continue observing newly promulgated government regulations within the state and in the broader U.S. market.