Relating to personal data processing practices for companies, and making civil penalties applicable

“Personal data” does not include de-identified or aggregate data or publicly available information. The bill defines “process” as the act of performing an operation on data, including collecting, storing, using, analyzing, disclosing, or deleting data. The bill details several disclosures a company must make and acts the company must perform. The bill also prohibits a company from processing data in a manner that the individual to whom the personal data pertains has not consented, and prohibits a company from denying or downgrading an individual’s service solely because the individual exercised a right granted under the bill. The bill details several rights that each resident of this state shall have relating to data. The bill authorizes the attorney general to investigate violations and enforce the bill.16 (consumer frauds). A resident of this state is allowed to bring a private action against a company for injunctive relief, civil penalties, and actual damages caused by an unauthorized entity obtaining the resident’s personal data due to the company’s failure to implement or maintain sufficient administrative, technical, and physical practices to ensure the security of personal data the company processes, or for a violation of the bill the company committed that resulted in actual damages to the resident. A violation of the bill is punishable by a civil penalty of up to $7,500 per violation per affected resident of this state. Penalties awarded to the state shall be deposited into the general fund of the state. The bill exempts personal data processed in the course of obtaining, issuing, or executing a valid warrant or subpoena; personal data processed solely for national security or law enforcement purposes; and personal data that has been de-identified or made anonymous so that the data can no longer be reasonably linked to an individual from the bill’s provisions.16.