Cybersecurity Policy Report, After Massive Breach, Data Broker Faces Small Fine in California, (Feb 20, 2025)
A Florida-based data broker that suffered a breach that exposed the personal information of potentially billions of people faces a fine of $46,000 over its failure to comply with California’s data broker registration law, the California Privacy Protection Agency (CPPA) announced today.
The relatively modest fine against Jerico Pictures, Inc., d/b/a National Public Data (NPD), belies the size of the breach the data broker disclosed last year (CPR, Aug. 22, 2024).
News reports about the breach indicated that as many as 2.9 billion individuals could have had their personal information, including Social Security numbers, exposed. Lower estimates suggested the number was closer to 272 million.
The California fine resulted from NPD’s failure to register as a data broker and pay a fee by Jan. 31, 2024, as required by the state’s DELETE Act, the CPPA said in a news release.
“National Public Data registered on September 18, 2024—or 230 days late—and did so only after the [CPPA] Enforcement Division had contacted the company during an investigation,” it said.
“The Enforcement Division has taken action against six data brokers since announcing an investigative sweep of data broker registration compliance, with the first five cases resulting in settlement,” it noted.
The CPPA reported that it first sought to fine NPD while the company was in Chapter 11 bankruptcy proceedings in the U.S. Bankruptcy Court for the Southern District of Florida.
The court ultimately dismissed the Chapter 11 case at the request of a federal trustee who noted that NPD had no insurance, no money, no employees, huge potential expenses related to the breach, and no chance of emerging from Chapter 11 as a going concern, according to court records.
NPD later announced its closure, and the Enforcement Division yesterday continued its efforts to collect the fine “by filing an administrative action against National Public Data,” the CPPA said.
“We will pursue data brokers who violate the law, plain and simple,” said Michael Macko, the agency’s head of enforcement. “I applaud our Enforcement team for its dogged pursuit of these violations. The Enforcement Division will use all available tools, including litigation, to make sure that data brokers aren’t operating in the dark.”
News: StateLegislation DataPrivacy DataBreach LitigationEnforcement CCPA