Display
Language
About accessibility
Language
Display
Sign in

Amendments › SF 2351

Amendment S-5084 to SF 2351

Relating to the removal of internet content upon request, and making penalties applicable

Never voted onStrike everything: replaces the whole bill

Filed March 11, 2020 in the Senate by Sen. Zach Nunn (R)

What it changes

AI summary This amendment replaces the entire bill with a new set of rules regarding personal data privacy. It gives individuals the right to access, correct, or stop the sale of their personal data and requires businesses to get consent before using sensitive information. It also sets security and transparency requirements for large companies that handle data for many people.1

Read the amendment’s wording
  1. By striking everything after the enacting clause and inserting: “Section
  2. NEW SECTION . 715D.1 Definitions. As used in this chapter, unless the context otherwise requires:
  3. “Breach of security” means the same as provided in section 715C.1.
  4. “Controller” means a person who, separately or in combination with another person, determines the purpose and methodology of the processing of personal data.
  5. “Custodian” means a partnership, corporation, limited liability company, unincorporated association, or other business or nonprofit entity that possesses personal data. “Custodian” does not include any of the following: a. The state or a political subdivision of the state. b. A partnership, corporation, limited liability company, unincorporated association, or other business entity which is located in the state, which is operated for profit and under a single management, and which has either fewer than twenty employees or an annual gross income of less than four million dollars computed as the average of the three preceding fiscal years.
  6. “Deidentified data” means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual or a device associated with an individual, provided that the controller or processor who possesses the data does all of the following: a. Takes reasonable measures to ensure that the data cannot be associated with an individual. b. Commits to maintain and use the data only in a deidentified fashion and does not attempt to reidentify the data. c. Contractually obligates recipients of the data to comply with all provisions of this chapter.
  7. “Geolocation data” means information that can be used to identify the physical location of an electronic device.
  8. “Minor” means an individual who is less than eighteen years of age.
  9. “Personal data” means any information that is linked or reasonably able to be linked to an identified or identifiable individual. “Personal data” does not include deidentified data, data that is lawfully obtained from publicly available sources, or data that is obtained from federal, state, or local government records lawfully made available to the general public.
  10. “Processor” means a person who processes personal data on behalf of a controller.
  11. “Sensitive data” means any of the following types of personal data: a. Data revealing an individual’s racial or ethnic origin, religious beliefs, mental condition, physical condition, or sexual orientation. b. A minor’s personal data. c. An individual’s geolocation data. d. An individual’s first name or first initial and last name in combination with any one or more of the following data elements that relate to the individual if any of the data elements are not encrypted, redacted, or otherwise altered by any method or technology in such a manner that the name or data elements are unreadable, or are encrypted, redacted, or otherwise altered by any method or technology but the keys to unencrypt, unredact, or otherwise read the data elements have been obtained through a breach of security: (1) Social security number. (2) Driver’s license number or other unique identification number created or collected by a government body. (3) Financial account number, credit card number, or debit card number in combination with any required expiration date, security code, access code, or password that would permit access to an individual’s financial account. (4) Unique electronic identifier or routing code, in combination with any required security code, access code, or password that would permit access to an individual’s financial account. (5) Unique genetic or biometric data, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of genetic or biometric data. (6) Data pertaining to the ownership or acquisition of a firearm. Sec.
  12. NEW SECTION . 715D.2 Personal data rights.
  13. An individual may request any of the following from a controller or a processor: a. A determination regarding whether the controller or processor possesses the individual’s personal data. b. Copies of the individual’s personal data that is in the possession of the controller or processor. c. Correction of the individual’s personal data that is in the possession of the controller or processor and that the individual indicates in the request is incorrect. d. Cessation of the controller or processor’s sale of the individual’s personal data. e. Cessation of the controller or processor’s use of the individual’s personal data for purposes of targeted advertising or profiling in furtherance of decisions that may result in the denial of consequential services or support, such as financial or lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, and access to basic necessities, such as food and water.
  14. Within forty-five days after the receipt of a request made pursuant to subsection 1, the controller or processor shall provide the information or take the action requested by an individual.
  15. Notwithstanding subsection 1 or 2, a controller or processor is not required to provide the information or take the action requested by an individual if the controller or processor is unable to authenticate the individual’s request using commercially reasonable efforts. The controller or processor may request additional information that is reasonably necessary to authenticate such a request. Sec.
  16. NEW SECTION . 715D.3 Prohibitions on certain practices of custodians. A custodian shall not do any of the following:
  17. Collect or use an individual’s sensitive data unless the custodian first obtains the individual’s consent to collect or use the sensitive data. An individual may withdraw the consent to collect or use the individual’s sensitive data at any time by providing notice to the custodian.
  18. Process personal data in violation of state or federal law that prohibits discrimination against consumers. Sec.
  19. NEW SECTION . 715D.4 Obligations of certain custodians. A custodian possessing the personal data of one hundred thousand or more individuals shall comply with all of the following:
  20. The custodian shall provide an accessible, clear, and meaningful privacy notice that informs consumers and potential consumers of all of the following: a. The personal data the custodian collects. b. How the custodian uses personal data in its possession. c. Persons the custodian allows to access or view personal data in the custodian’s possession, and why the custodian allows such persons to access or view the personal data. d. The individual’s rights under sections 715D.2 and 715D.3.
  21. The custodian’s collection and processing of personal data shall be limited to the types and amounts of personal data that are reasonably necessary in relation to the purpose for which the personal data is collected or processed.
  22. The custodian shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. The custodian’s data security practices shall be appropriate for the volume and nature of the personal data the custodian possesses.
  23. The custodian shall conduct and document a data protection assessment addressing each of the following activities involving personal data: a. The custodian’s processing of personal data for purposes of targeted advertising. b. The custodian’s sale of personal data. c. The custodian’s processing of personal data for purposes of profiling where such profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of consumers, financial injury to consumers, reputational injury to consumers, an intrusion upon the private affairs of consumers that would be offensive to a reasonable person, or other substantial injury. d. The custodian’s processing of sensitive data. e. The custodian’s processing activities involving personal data that present a heightened risk of harm to consumers.
  24. The custodian shall provide to the attorney general upon request the data protection assessment prepared pursuant to subsection
  25. Sec.
  26. NEW SECTION . 715D.5 Limitations. This chapter shall not be construed to restrict or prevent a controller, custodian, or processor from doing any of the following:
  27. Complying with any federal, state, or local law or regulation.
  28. Complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, or local governmental authority.
  29. Cooperating with law enforcement concerning conduct or activity that the controller, custodian, or processor reasonably believes may violate federal, state, or local laws or regulations.
  30. Investigating, preparing for, or defining legal claims. Sec.
  31. NEW SECTION . 715D.6 Enforcement. A violation of this chapter is an unlawful practice under section 714.16, and all the remedies pursuant to section 714.16 are available for such an action. Sec.
  32. NEW SECTION . 715D.7 Remedies cumulative. The rights, remedies, and prohibitions contained in this chapter shall be in addition to and cumulative of any other right, remedy, or prohibition accorded by common law or state or federal law. This chapter shall not be construed to deny, abrogate, or impair any such common law or statutory right, remedy, or prohibition. Sec.
  33. NEW SECTION . 715D.8 Application. This chapter shall not apply to any of the following:
  34. A person who is subject to and complies with regulations promulgated pursuant to Tit. V of the federal Gramm-Leach-Bliley Act of 1999, 15 U.S.C. §6801 –
  36. A person who is subject to and complies with regulations promulgated pursuant to Tit. II, subtit. F of the federal Health Insurance Portability and Accountability Act of 1996, 42 U.S.C. §1320d – 1320d-9, and Tit. XIII, subtit. D of the federal Health Information Technology for Economic and Clinical Health Act of 2009, 42 U.S.C. §17921 –
  37. ”
  38. Title page, by striking lines 1 and 2 and inserting “An Act relating to personal data, including an individual’s rights with respect to personal data, the obligations of certain persons with respect to personal data, and making penalties applicable.”

Official amendment (PDF) · In the Bill Book