Bill Text: HI SB418 | 2019 | Regular Session | Introduced


Bill Title: Relating To Privacy.

Spectrum: Partisan Bill (Democrat 2-0)

Status: (Introduced) 2019-01-24 - Referred to CPH, JDC. [SB418 Detail]

Download: Hawaii-2019-SB418-Introduced.html

THE SENATE

S.B. NO.

418

THIRTIETH LEGISLATURE, 2019

 

STATE OF HAWAII

 

 

 

 

 

 

A BILL FOR AN ACT

 

 

relating to privacy.

 

 

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF HAWAII:

 


     SECTION 1.  The legislature finds that information technology is constantly growing in prominence and ubiquity.  As the role of technology and data in the daily lives of consumers increases, there is a corresponding increase in the amount of identifying information shared by consumers with businesses.  Many businesses collect identifying information from consumers, including such things as where a consumer lives; how many children a consumer has; how fast a consumer drives; a consumer's sleep habits, biometric data, and health information; a consumer's financial information; precise geolocation information relating to a consumer's position; and information accessible through social media networks.

     The legislature further finds that the unauthorized disclosure of identifying information and loss of privacy can have devastating effects for individuals, ranging from financial fraud, identity theft, and unnecessary personal time and financial costs to destruction of property, harassment, reputational damage, emotional stress, and even potential physical harm.  In March 2018, it came to light that tens of millions of people had their personal data misused by a data mining firm called Cambridge Analytica.  A series of congressional hearings highlighted that identifying information may be vulnerable to misuse when shared on the internet.  These proceedings exposed the lack of any sort of sunshine law for internet data brokers and highlighted the need for such a law.

     Accordingly, the purpose of this Act is to:

     (1)  Require a business to disclose the categories and specific pieces of identifying information that the business collects about a consumer upon verifiable request from the consumer;

     (2)  Require a business to disclose the identity of third parties to which the business has sold or transferred identifying information about a consumer upon verifiable request from the consumer;

     (3)  Require a business to publicly disclose the categories of identifying information that the business collects from consumers and the purposes for collection;

     (4)  Require a business to delete identifying information collected from a consumer upon verifiable request from the consumer;

     (5)  Authorize consumers to opt out of the sale of identifying information by a business;

     (6)  Prohibit a business from selling the identifying information of an individual under sixteen years of age unless affirmatively authorized to do so; and

     (7)  Prohibit a business from discriminating against consumers who exercise their rights to request disclosures or deletions or to opt out.

     SECTION 2.  Chapter 487J, Hawaii Revised Statutes, is amended by adding a new part to be appropriately designated and to read as follows:

"Part    .  Collection of Identifying information

     §487J-A  Definitions.  As used in this part:

     "Business purpose" means the use of identifying information for the business's or a service provider's operational purposes in a manner that is necessary and proportionate to achieve the operational purpose for which the identifying information was collected or processed or compatible with the context in which the identifying information was collected, including but not limited to:

     (1)  Auditing related to a current interaction with the consumer and concurrent transactions;

     (2)  Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;

     (3)  Debugging to identify and repair errors that impair existing intended functionality;

     (4)  Short-term transient use, including but not limited to the contextual customization of advertisements shown as part of the same interaction; provided that the identifying information is not disclosed to a third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction;

     (5)  Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders or transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider;

     (6)  Undertaking internal research for technological development and demonstration;

     (7)  Undertaking activities to verify or maintain the quality or safety of a service or device that is owned by, manufactured by, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned by, manufactured by, manufactured for, or controlled by the business.

     "Collect" means buying, renting, gathering, obtaining, receiving, or accessing identifying information by any means; provided that "collect" does not include gathering, obtaining, receiving, or accessing information for the purpose of a single, one-time transaction if the information is not sold or retained by the business.

     "Commercial purpose" means to advance a person's commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.  "Commercial purpose" does not include engaging in speech that state or federal courts have recognized as noncommercial speech, including political speech and journalism.

     "Consumer" means an individual who interacts with a business within the State.

     "Designated methods for submitting requests" means a mailing address, email address, internet web page, internet web portal, toll-free telephone number, or other applicable contact information, whereby consumers may submit a request or direction under this part, including any new means of contacting a business as approved by the office.

     "Device" means any physical object that is capable of electronic communication through connecting to the Internet, directly or indirectly, or to another device.

     "Homepage" means the introductory page of an internet web site and any internet web page where identifying information is collected.  In the case of an online services such as a mobile application, "homepage" includes the application's platform page or download page; a link within the application, such as from the application configuration; "about", "information", or settings page, and any other location that allows consumers to review the notices or disclosures required under this part.

     "Identifying information" means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including but not limited to the following categories:

     (1)  Identifiers such as a real name, alias, postal address, unique identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, signature, or other similar identifier;

     (2)  Characteristics of protected classifications under Hawaii or federal law;

     (3)  Commercial information, including records of personal property, products, or services purchased, obtained, or considered, or other purchasing or consuming history or tendencies;

     (4)  Biometric information;

     (5)  Internet and other electronic network activity information including but not limited to browsing history, search history, and information regarding a consumer's interaction with an internet web site, application, or advertisement;

     (6)  Geolocation data;

     (7)  Audio, electronic, visual, thermal, olfactory, or similar recordings;

     (8)  Professional or employment-related information;

     (9)  Education records, as defined in title 20 United States Code section 1232g(a)(4);

    (10)  Medical data;

    (11)  Insurance information;

    (12)  Financial information; or

    (13)  Profiles about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes that are created from inferences from any other information collected from a consumer.

"Identifying information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

     "Insurance information" means a consumer's insurance policy number or subscriber identification number, any unique identifier used by an insurer to identify the consumer, or any information in the consumer's application and claims history, including any appeal records, if the information is linked or reasonably linkable to a consumer or household, including via a device, by a business or service provider.

     "Office" means the office of consumer protection.

     "Sell" includes the sale, rent, release, disclosure, dissemination, making available, transfer, or communication of through other means including but not limited to orally, in writing, and electronically, of a consumer's identifying information by the business to another business or third party for monetary or other valuable consideration; provided that a business does not sell identifying information when:

     (1)  A consumer uses or directs the business to intentionally disclose identifying information or uses the business to intentionally interact with a third party; provided that the third party does not also sell the identifying information, unless that disclosure would be consistent with this part; provided further that intentional interaction occurs when a consumer intends to interact with the third party through one or more deliberate actions, and that hovering over, muting, pausing, or closing a given piece of content does not constitute a consumer's intent to interact with a third party;

     (2)  The business uses or shares an identifier with a service provider identifying information of a consumer who has opted out of the sale of the consumer's identifying information for the purposes of alerting third parties that the consumer has exercised the right to opt out under section 487J-F;

     (3)  The business uses or shares with a service provider identifying information of a consumer that is necessary for business purposes; provided that:

          (A)  The service provider also does not sell the consumer's identifying information; and

          (B)  The business has provided notice that information is being used or shared in its terms and conditions consistent with section 487J-H(c); or

     (4)  The business transfers to a third party the identifying information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the business; provided that neither the business nor the third party otherwise engages in conduct that meets the definition of "sell".

     "Unique identifier" means a persistent identifier that can be used to recognize a consumer, a family, or a device that is linked to a consumer or family, over time and across different services, including but not limited to a device identifier; Internet protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar technology; customer number, unique pseudonym, or user alias; telephone number; or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device.

     "Verifiable request" means a request that is made by a consumer, by a consumer on behalf of the consumer's minor child, or by a person authorized by the consumer to act on the consumer's behalf, and that the business can reasonably verify pursuant to rules adopted by the office.

     §487J-B  Businesses that collect identifying information; required notification.  (a)  A business that collects identifying information from a consumer shall, at or before the point of collection, notify the consumer as to the categories of identifying information to be collected and the purposes for which the information is to be used.  A business shall not collect additional categories of identifying information or use identifying information for additional purposes without providing the consumer with notice.

     (b)  The notification required under this section shall include a statement of the consumer's right to request disclosure pursuant to section 487J-C or deletion of identifying information pursuant to section 487J-D.

     (C)  A business that collects identifying information through online interactions shall post notification required under this section on the business's website.

     §487J-C  Disclosure by request.  (a)  A business that collects identifying information from a consumer shall, upon verifiable request from the consumer, disclose the identifying information that the business has collected about the consumer, including:

     (1)  The categories of identifying information the business has collected about the consumer;

     (2)  The sources from which the identifying information about the consumer has been collected;

     (3)  The specific pieces of identifying information that the business has collected from the consumer;

     (4)  The business or commercial purposes for collecting or sharing the identifying information; and

     (5)  The categories of third parties with whom the business has shared identifying information about the consumer.

     (b)  Disclosures made pursuant to this section shall be free of charge to the consumer requesting the disclosure, and may be delivered by mail or electronically.

     §487J-D  Deletion by request.  (a)  A business that collects identifying information from a consumer shall, upon verifiable request from the consumer, delete all identifying information that the business has collected about the consumer.

     (b)  Deletion of identifying information pursuant to this section shall be free of charge to the consumer requesting the deletion.

     (c)  A business that receives a verifiable request to delete a consumer's identifying information pursuant to this section shall direct any service providers to delete the consumer's identifying information from their records.

     (d)  A business shall not be required to comply with a request to delete a consumer's identifying information if it is necessary for the business to maintain the consumer's identifying information in order to:

     (1)  Complete the transaction for which the identifying information was collected, provide a good or service requested by the consumer or reasonably anticipated within the context of a business's ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer;

     (2)  Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; prosecute persons responsible for illegal activity; or initiate and pursue legal proceedings in good faith;

     (3)  Debug to identify and repair errors that impair existing intended functionality;

     (4)  Exercise free speech, ensure the right of another consumer to exercise free speech, or exercise another right provided for by law;

     (5)  Comply with the requirements of state or federal law;

     (6)  Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws when the business's deletion of the identifying information is likely to render impossible or seriously impair the achievement of the research and the consumer has provided informed consent;

     (7)  Enable solely internal uses that are reasonably aligned with the expectations of the consumer, based on the consumer's relationship with the business;

     (8)  Comply with a legal obligation; or

     (9)  Otherwise use the consumer's identifying information, internally, in a lawful manner that is compatible with the context in which the consumer provided the information.

     §487J-E  Disclosure by request of sale or third-party disclosure.  (a)  A business that sells identifying information from a consumer or discloses identifying information from a consumer to a third party for business purposes shall, upon verifiable request from the consumer, disclose to that consumer:

     (1)  The categories of identifying information that the business collected about the consumer;

     (2)  The categories of identifying information about the consumer that the business sold and the categories of third parties to whom the identifying information was sold, by category or categories of identifying information for each third party to whom the identifying information was sold; and

     (3)  The categories of identifying information about the consumer that the business disclosed for a business purpose.

     (b)  Disclosures made pursuant to this section shall be free of charge to the consumer requesting the disclosure, and may be delivered by mail or electronically.

     §487J-F  Sale of identifying information; required notification; right of the consumer to opt out; right of consumers less than sixteen years of age to opt in.  (a)  A business that sells a consumer's identifying information to a third party shall, at or before the point of collection, notify the consumer that the information may be sold and that the consumer has the right to opt out of the sale of their identifying information.  A business that collects identifying information through online interactions shall post notification required under this section on the business's website.

     (b)  A consumer shall have the right, at any time, to direct a business that sells identifying information about the consumer to a third party not to sell the consumer's information to any third party.  This right may be referred to as the right to opt out.

     (c)  A business that has received direction from a consumer not to sell the consumer's identifying information shall not sell the consumer's identifying information after receipt of the consumer's direction unless the consumer subsequently provides express authorization for the sale of the consumer's identifying information.

     (d)  A third party shall not sell identifying information about a consumer that has been sold to the third party by a business unless the consumer has received explicit notice and is provided an opportunity to exercise the right to opt out pursuant to subsection (b).

     (e)  Notwithstanding any law to the contrary, a business shall not sell the identifying information of a consumer if the business has actual knowledge that the consumer is less than sixteen years of age, unless the consumer, in the case of consumers between thirteen and sixteen years of age, or the consumer's parent or guardian, in the case of consumers who are less than thirteen years of age, has affirmatively authorized the sale of the consumer's identifying information.  A business that willfully disregards the consumer's age shall be deemed to have actual knowledge of the consumer's age.  This right may be referred to as the right to opt in.

     (f)  A consumer may authorize a person to act on the consumer's behalf for the purposes of this section pursuant to rules adopted by the office.

     §487J-G  Discrimination due to request to disclose or delete identifying information prohibited; incentives permitted.  (a)  A business shall not discriminate against a consumer because the consumer exercised any of the consumer's rights under this part in ways including but not limited to:

     (1)  Denying goods or services to the consumer;

     (2)  Charging different prices or rates for goods or services, including through the use of discounts or other benefits or by imposing penalties;

     (3)  Providing a different level or quality of goods or services to the consumer; or

     (4)  Suggesting that the consumer will receive a different price or rate for goods or services or a different level of quality of goods or services;

provided that this subsection does not prohibit a business from charging a consumer a different price or rate, or from providing a different level or quality of goods or services, if that difference is reasonably related to the value provided to the consumer by the consumer's identifying information.

     (b)  A business may offer:

     (1)  Financial incentives, including payments to consumers as compensation, for the collection of identifying information, sale of identifying information, or deletion of identifying information; or 

     (2)  A different price, rate, level, or quality of goods or services to the consumer if that price or difference is directly related to the value provided to the consumer by the consumer's identifying information;

provided that a business that offers incentives related to identifying information shall provide notice of those incentives pursuant to section 487J-H(d).

     (c)  A business may enter a consumer into a financial incentive program under subsection (b) only if the consumer gives the business prior opt-in consent that clearly describes the material terms of the financial incentive program, and that may be revoked by the consumer at any time.

     §487J-H  Compliance procedures.  (a)  For the purposes of complying with disclosure requirements under this part, a business shall, in a form that is reasonably accessible to consumers who interact with the business:

     (1)  Make available two or more designated methods for submitting requests for information required to be disclosed pursuant to sections 487J-C and 487J-E, including, at a minimum, a toll-free telephone number and, if the business maintains an internet web site, a web site address;

     (2)  Disclose and deliver the information requested by a consumer within forty-five days of receiving a verifiable request from the consumer; provided that:

          (A)  The business shall take steps to determine whether the request is a verifiable request; provided that this process shall not extend the business's duty to disclose and deliver the information within forty-five days of receipt of the consumer's request;

          (B)  The time period to provide the required information may be extended once by an additional forty-five days when reasonably necessary; provided that the consumer who made the request is provided notice of the extension within the first forty-five-day period;

          (C)  The disclosure shall cover the twelve-month period preceding the business's receipt of the verifiable request and shall be made in writing and delivered through the consumer's account with the business if the consumer maintains an account with the business, or by mail or electronically at the consumer's option if the consumer does not maintain an account with the business;

          (D)  The disclosure shall be made in a readily usable format that allows the consumer who made the request to transmit the information from one entity to another without hindrance; and

          (E)  The business shall not require a consumer to create an account with the business in order to make a verifiable request;

     (3)  For the purposes of section 487J-C:

          (A)  Identify the consumer making the verifiable request and associate the information provided by the consumer in the request to any identifying information previously collected by the business about the consumer; and

          (B)  Identify and list by category or categories the identifying information collected about the consumer in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information collected;

     (4)  For the purposes of section 487J-E:

          (A)  Identify the consumer making the verifiable request and associate the information provided by the consumer in the request to any identifying information previously collected by the business about the consumer;

          (B)  Identify and list by category or categories the identifying information collected about the consumer in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information collected and describe the third parties to whom the consumer's identifying information was sold in the preceding twelve months;

          (C)  In a list that is separate from the list generated for the purposes of subparagraph (B), identify and list by category or categories the identifying information collected about the consumer in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information collected and describe the third parties to whom the consumer's identifying information was disclosed for a business purpose in the preceding twelve months

     (5)  Disclose the following information in its online privacy policy or policies if the business has an online privacy policy or policies and update that information at least once every twelve months:

          (A)  A description of the consumer's rights pursuant to sections 487J-C and 487J-E, and one or more designated methods for submitting requests;

          (B)  For the purposes of section 487J-C, a list of the categories of personal information it has collected about all consumers in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information collected;

          (C)  For the purposes of section 487J-E:

              (i)  A list of the categories of identifying information it has sold about all consumers in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information sold or, if the business has not sold identifying information in the preceding twelve months, it shall disclose that fact; and

             (ii)  A list of the categories of identifying information it has disclosed for business purposes about all consumers in the preceding twelve months by reference to the enumerated category or categories in section 487J-A that most closely describe the identifying information disclosed or, if the business has not disclosed identifying information for business purposes in the preceding twelve months, it shall disclose that fact;

     (6)  Ensure that all individuals responsible for handling inquiries about the business's compliance with disclosure requirements under this part are informed of all requirements of this part and how to direct consumers to exercise their rights to request disclosures under this part; and

     (7)  Use any identifying information collected from a consumer for the purpose of verifying the consumer's request solely for the purpose of verification.

     (b)  A business is not obligated to provide a consumer with information under sections 487J-C or 487J-E more than twice for each section in a twelve-month period.

     (c)  A business that is required to comply with section 487J-F shall, in a form that is reasonably accessible to consumers:

     (1)  Provide a clear and conspicuous link on the business's internet homepage, titled "Do Not Sell My Identifying Information", to an internet web page that enables a consumer, or a person authorized by the consumer, to opt out of the sale of the consumer's identifying information;

     (2)  Include a description of a consumer's rights pursuant to section 487J-F, in addition to a separate link to the "Do Not Sell My Identifying Information" internet web page in its online privacy policy or policies if the business has an online privacy policy or policies;

     (3)  Ensure that all individuals responsible for handling consumer inquiries about the business's privacy practices or the business's compliance with this part are informed of all requirements of section 487J-F and this section and how to direct consumers to exercise their rights under those sections;

     (4)  Refrain from requesting that a consumer who opted out of the sale of the consumer's identifying information re-authorize sale of the consumer's identifying information for at least twelve months from the date that the consumer opted out; and

     (5)  Use any identifying information collected from the consumer in connection with the submission of the consumer's opt-out request solely for the purposes of complying with the opt-out request.

     (d)  A business that offers financial incentives under section 487J-G(b) shall, in a form that is reasonably accessible to consumers, provide notice of the full terms and conditions of the financial incentives and a clear and unambiguous method for the consumer to opt-in to the incentives.

     (e)  Nothing in this part shall require a business to comply with the part by including the required links and text on the homepage that a business makes available to the public generally if the business maintains a separate and additional homepage that is dedicated to consumers in Hawaii and that includes the required links and text, and the business takes reasonable steps to ensure that consumers in Hawaii are directed to the homepage for consumers in Hawaii and not the homepage made available to the public generally.

     (f)  A business shall comply with a request received from a person authorized by the consumer to act on the consumer's behalf pursuant to section 487J-F(f).

     §487J-I  Extensions.  Unless otherwise provided under this part, a business shall respond to a verifiable request within ninety days of receiving the request, and may extend the response period by ninety days when necessary; provided that the business provides notice of the extension, including the reason for the extension, to the consumer within forty-five days of receiving the request.

     §487J-J  Denial of requests.  (a)  If requests from a consumer are manifestly unfounded, excessive, or repetitive, a business may:

     (1)  Charge a reasonable fee, taking into account the administrative costs of taking the requested action; or

     (2)  Refuse to act on the request.

     (b)  A business shall bear the burden of establishing that a verifiable request is manifestly unfounded, excessive, or repetitive.

     (c)  A business that does not take action on a verifiable request shall, within the time period permitted for response, notify the consumer who made the request of the following:

     (1)  The business's refusal to take action;

     (2)  The reasons for the refusal; and

     (3)  Any rights the consumer may have to appeal the decision to the business.

     §487J-K  Administration; rules.  This part shall be administered and enforced by the office of consumer protection.  The office shall adopt rules in accordance with chapter 91 for the purposes of this part.

     §487J-L  Agreements limiting rights and remedies; unenforceable.  Any provision of a contract or agreement that purports to waive or limit in any way a consumer's rights under this part, including but not limited to a right to a remedy or means of enforcement, shall be deemed contrary to public policy and shall be unenforceable; provided that this section shall not compel any consumer to exercise a right or pursue a remedy if the consumer voluntarily elects not to do so."

     SECTION 3.  Chapter 487J, Hawaii Revised Statutes, is amended by designating sections 487J-1 to 487J-7 as part I and inserting a title before section 487J-1 to read as follows:

"PART I.  GENERAL PROVISIONS"

     SECTION 4.  Section 487N-2, Hawaii Revised Statutes, is amended by amending subsections (a) and (b) to read as follows:

     "(a)  Any business that owns or licenses personal information of residents of Hawaii, any business that conducts business in Hawaii that owns or licenses personal information in any form (whether computerized, paper, or otherwise), any business that collects identifying information as provided in part     of chapter 487J, or any government agency that collects personal information for specific government purposes shall provide notice to the affected person that there has been a security breach following discovery or notification of the breach.  The disclosure notification shall be made without unreasonable delay, consistent with the legitimate needs of law enforcement as provided in subsection (c) of this section, and consistent with any measures necessary to determine sufficient contact information, determine the scope of the breach, and restore the reasonable integrity, security, and confidentiality of the data system.

     (b)  Any business located in Hawaii or any business that conducts business in Hawaii that maintains or possesses records or data containing personal information of residents of Hawaii that the business does not own or license, any service provider that receives, maintains, or possesses identifying information as provided in part     of chapter 487J, or any government agency that maintains or possesses records or data containing personal information of residents of Hawaii shall notify the owner or licensee of the information of any security breach immediately following discovery of the breach, consistent with the legitimate needs of law enforcement as provided in subsection (c)."

     SECTION 5.  This Act does not affect rights and duties that matured, penalties that were incurred, and proceedings that were begun before its effective date.

     SECTION 6.  If any provision of this Act, or the application thereof to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable.

     SECTION 7.  New statutory material is underscored.

     SECTION 8.  This Act shall take effect upon its approval.

 

INTRODUCED BY:

_____________________________

 

 

 

 

 

 

 

 


 


 

Report Title:

Identifying Information; Privacy; Businesses; Consumers; Disclosure; Deletion; Office of Consumer Protection

 

Description:

Requires a business to:  disclose the categories and specific pieces of identifying information collected about a consumer upon verifiable request from the consumer; disclose the identity of third parties to which the business has sold or transferred identifying information about a consumer upon verifiable request from the consumer; publicly disclose the categories of identifying information that collected from consumers and the purposes for collection; and delete identifying information collected from a consumer upon verifiable request from the consumer.  Authorizes consumers to opt out of the sale of identifying information by a business.  Prohibits a business from selling the identifying information of an individual under sixteen years of age unless affirmatively authorized to do so.  Prohibits a business from discriminating against consumers who exercise their rights to request disclosures or deletions or to opt out.

 

 

 

The summary description of legislation appearing on this page is for informational purposes only and is not legislation or evidence of legislative intent.

feedback