Bill Text: WV HB4325 | 2022 | Regular Session | Introduced
Bill Title: Providing online privacy protection laws for children under 18 years of age
Spectrum: Partisan Bill (Republican 10-0)
Status: (Introduced - Dead) 2022-01-21 - To House Judiciary [HB4325 Detail]
Download: West_Virginia-2022-HB4325-Introduced.html
WEST VIRGINIA LEGISLATURE
2022 REGULAR SESSION
Introduced
House Bill 4325
By Delegates Clark, Steele, Linville, Pinson, Fast, Keaton, Hanna, Riley, Graves and Mandt
[Introduced January 21, 2022; Referred to the Committee on the Judiciary]
A BILL to amend the Code of West Virginia, 1931, as amended, by adding thereto a new article, designated §46A-9-1, §46A-9-2, §46A-9-3, §46A-9-4, and §46A-9-5, all relating to online privacy protection for children; defining terms; establishing actions prohibited; creating rulemaking authority; providing safe harbor for operators; and providing for enforcement by the attorney general.
Be it enacted by the Legislature of West Virginia:
Article 9. Online privacy protection for children.
§46A-9-1. Legislative Findings and Statutory Construction.
The Legislature hereby declares that the purpose of this article is to complement the body of federal law governing online privacy protections for children. It is the intent of the Legislature that, in construing this article, the courts be guided by the policies of the Federal Trade Commission and interpretations given by the Federal Trade Commission and the federal courts to the Children’s Online Privacy Protection Act (15 USC 6501), as from time to time amended, and to the various other federal statutes dealing with the same or similar matters. To this end, this article shall be liberally construed so that its beneficial purposes may be served.
§46A-9-2. Definitions.
In this article:
(1) Child. The term “child” means an individual under the age of 18.
(2) Operator. The term “operator” means any person who operates a website located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such website or online service, or on whose behalf such information is collected or maintained, where such website or online service is operated for commercial purposes, including any person offering products or services for sale through that website or online service, involving commerce in the State of West Virginia;
(3) Disclosure. The term “disclosure” means, with respect to personal information:
(A) The release of personal information collected from a child in identifiable form by an operator for any purpose, except where such information is provided to a person other than the operator who provides support for the internal operations of the website and does not disclose or use that information for any other purpose; and
(B) Making personal information collected from a child by a website or online service directed to children or with actual knowledge that such information was collected from a child, publicly available in identifiable form, by any means including by a public posting, through the Internet, or through:
(i) A home page of a website;
(ii) A pen pal service;
(iii) An electronic mail service;
(iv) A message board; or
(v) A chat room.
(4) Internet. The term “Internet” means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire or radio.
(5) Parent. The term “parent” includes a legal guardian.
(6) Personal information. The term “personal information” means individually identifiable information about an individual collected online, including—
(A) A first and last name;
(B) A home or other physical address including street name and name of a city or town;
(C) An e-mail address;
(D) A telephone number;
(E) A Social Security number;
(F) Any other identifier that the Attorney general determines permits the physical or online contacting of a specific individual; or
(G) Information concerning the child or the parents of that child that the website collects online from the child and combines with an identifier described in this paragraph.
(7) Verifiable parental consent. The term “verifiable parental consent” means any reasonable effort (taking into consideration available technology), including a request for authorization for future collection, use, and disclosure described in the notice, to ensure that a parent of a child receives notice of the operator’s personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child.
(8) Website or online service directed to children.
(A) In general. The term “website or online service directed to children” means—
(i) a commercial website or online service that is targeted to children; or
(ii) that portion of a commercial website or online service that is targeted to children.
(B) Limitation. A commercial website or online service, or a portion of a commercial website or online service, shall not be deemed directed to children solely for referring or linking to a commercial website or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.
(9) Person. The term “person” means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.
(10) Online contact information. The term “online contact information” means an e-mail address or another substantially similar identifier that permits direct contact with a person online.
(a) Acts prohibited
(1) In general — It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).
(2) Disclosure to parent protected — Notwithstanding subdivision (1), neither an operator of such a website or online service nor the operator’s agent shall be held to be liable for any disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subsection (b)(1)(B)(iii) to the parent of a child.
(1) In general — Not later than March 1, 2023, the Attorney General shall propose rules for legislative approval in accordance with the provisions of §29A-3-1 et seq. of this code —
(A) Require the operator of any website or online service directed to children that collects personal information from children or the operator of a website or online service that has actual knowledge that it is collecting personal information from a child:
(i) To provide notice on the website of what information is collected from children by the operator, how the operator uses such information, and the operator’s disclosure practices for such information; and
(ii) To obtain verifiable parental consent for the collection, use, or disclosure of personal information from children;
(B) Require the operator to provide, upon request of a parent under this subparagraph whose child has provided personal information to that website or online service, upon proper identification of that parent, to such parent:
(i) A description of the specific types of personal information collected from the child by that operator;
(ii) The opportunity at any time to refuse to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child; and
(iii) Notwithstanding any other provision of law, a means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child;
(C) Prohibit conditioning a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity; and
(D) Require the operator of such a website or online service to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.
(2) When consent not required — The regulations shall provide that verifiable parental consent under subdivision (1)(A)(ii) is not required in the case of:
(A) Online contact information collected from a child that is used only to respond directly on a one-time basis to a specific request from the child and is not used to recontact the child and is not maintained in retrievable form by the operator;
(B) A request for the name or online contact information of a parent or child that is used for the sole purpose of obtaining parental consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if parental consent is not obtained after a reasonable time;
(C) Online contact information collected from a child that is used only to respond more than once directly to a specific request from the child and is not used to recontact the child beyond the scope of that request—
(i) If, before any additional response after the initial response to the child, the operator uses reasonable efforts to provide a parent notice of the online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or
(ii) Without notice to the parent in such circumstances as the attorney general may determine are appropriate, taking into consideration the benefits to the child of access to information and services, and risks to the security and privacy of the child, in rules promulgated under this subsection;
(D) The name of the child and online contact information (to the extent reasonably necessary to protect the safety of a child participant on the site):
(i) Used only for the purpose of protecting such safety;
(ii) Not used to recontact the child or for any other purpose; and
(iii) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent notice of the name and online contact information collected from the child, the purposes for which it is to be used, and an opportunity for the parent to request that the operator make no further use of the information and that it not be maintained in retrievable form; or
(E) The collection, use, or dissemination of such information by the operator of such a website or online service is necessary:
(i) To protect the security or integrity of its website;
(ii) To take precautions against liability;
(iii) To respond to judicial process; or
(iv) To the extent permitted under other provisions of law, to provide information to law- enforcement agencies or for an investigation on a matter related to public safety.
(3) Termination of service. The regulations shall permit the operator of a website or an online service to terminate service provided to a child whose parent has refused, under the rules prescribed under subdivision (1)(B)(ii), to permit the operator’s further use or maintenance in retrievable form, or future online collection, of personal information from that child.
(c) Enforcement. Subject to §46A-9-4 and §46A-9-5 of this code, a violation of a rule prescribed under subsection (b) shall be treated as a violation of subsection (a) of this section.
(d) Inconsistent State law — No local government may impose any liability for commercial activities or actions by operators in interstate or foreign commerce in connection with an activity or action described in this chapter that is inconsistent with the treatment of those activities or actions under this section.
§46A-9-4. Safe Harbor.
(a) Guidelines.-- An operator may satisfy the requirements of the rules issued under §46A-9-2 of this code describing prohibited acts by following a set of self-regulatory guidelines, issued by representatives of the marketing or online industries, or by other persons, approved under subsection (b).
(b) Incentives.
(1) Self-regulatory incentives. In prescribing rules under the Attorney General shall provide incentives for self-regulation by operators to implement the protections afforded children under the requirements described in subsection (b) of that section.
(2) Deemed compliance. Such incentives shall include provisions for ensuring that a person will be deemed to be in compliance with the requirements of the rules promulgated under §46A-9-2 of this code if that person complies with guidelines that, after notice and comment, are approved by the Attorney General upon making a determination that the guidelines meet the requirements of the rules issued under §46A-9-2 of this code.
(3) Expedited response to requests. The Attorney General shall act upon requests for safe harbor treatment within 180 days of the filing of the request, and shall set forth in writing its conclusions with regard to such requests.
(c) Appeals.-- Final action by the Attorney General on a request for approval of guidelines, or the failure to act within 180 days on a request for approval of guidelines, submitted under subsection (b) may be appealed to a circuit court in Kanawha County.
§46A-9-5. Enforcement.
(a) In general.-- Except as otherwise provided, this chapter shall be enforced by the Attorney General under the West Virginia Consumer Credit and Protection Act, §46A-1-1 et seq. of this code.
(b) Actions by Attorney General.-- The Attorney General shall prevent any person from violating a rule of the Attorney General promulgated under §46A-9-2 of this code in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the West Virginia Consumer Credit and Protection Act, as though §46A-1-1 et seq. of this code was incorporated and made a part of this chapter. Any entity that violates such rule shall be subject to the penalties and entitled to the privileges and immunities provided in the West Virginia Consumer Credit Protection Act in the same manner, by the same means, and with the same jurisdiction, power, and duties as though all applicable terms and provisions of the West Virginia Consumer Credit Protection Act were incorporated into and made a part of this article.
(c) Effect on other laws.-- Nothing contained in this chapter shall be construed to limit the authority of the Attorney General under any other provisions of law.
NOTE: The purpose of this bill is to provide online privacy protections for children under the age of 18.
Strike-throughs indicate language that would be stricken from a heading or the present law and underscoring indicates new language that would be added.
