California Privacy Regulator Targets Florida Data Broker with Fines After Massive Social Security Numbers Breach
In recent developments surrounding data privacy in California, the state’s privacy regulator is pursuing legal action against a data broker that experienced one of the largest data breaches in 2024. The California Privacy Protection Agency (CPPA) is seeking to impose a fine of $46,000 on National Public Data for failing to comply with registration requirements under the California Consumer Privacy Act (CCPA).
Overview of the Data Breach Incident
In April 2024, National Public Data made headlines when hackers accessed its databases, leading to the theft of hundreds of millions of Social Security numbers and other personal details. This breach is estimated to have affected around 270 million individuals, with approximately three billion records compromised, although much of the information was found to be inaccurate.
Consequences for National Public Data
- The significant data breach marked one of the largest incidents of 2024.
- Following the breach, National Public Data filed for bankruptcy protection, citing an inability to pay debts.
- A Florida bankruptcy court, however, rejected the company’s petition in November 2024, which may allow creditors and authorities to pursue legal action.
CPPA’s Enforcement Actions
The CPPA has reported that it filed a claim against National Public Data last year due to the company’s failure to register as a data broker with the agency. As a result of the bankruptcy court’s ruling, the CPPA is actively seeking the $46,000 fine from the data broker.
Registration Requirements for Data Brokers
Data brokers, such as National Public Data, are required to register with the CPPA if they collect and sell personal information, including location data. The registration deadline was set for January 31, 2024, and those who failed to comply could face fines of up to $200 per day. National Public Data only registered on September 18, 2024, after being contacted by enforcement officials.
CPPA’s Track Record with Data Brokers
This action against National Public Data is the sixth enforcement effort by the CPPA since its establishment. The agency has previously resolved five cases through settlement agreements.
For more information on data privacy regulations in California, you can visit the California Attorney General’s website.
Despite requests for comments, Salvatore Verini, the owner of Jerico Pictures, the parent company of National Public Data, has not responded.
