Consumer Data Protection Act; data deletion request.

Consumer Data Protection Act; data deletion request. Provides that a controller that has obtained personal data about a consumer from a third party shall be deemed in compliance with a consumer's request to delete such data if the controller either (i) retains a record of the deletion request and the minimum data necessary for the purpose of ensuring that the consumer's personal data remains deleted and does not use such retained data for any other purpose or (ii) opts the consumer out of the processing of that data for any purpose except those purposes exempted pursuant to the Consumer Data Protection Act. This bill is identical to SB 393.