ENGR. H. B. NO. 1602 Page 1 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
ENGROSSED HOUSE
BILL NO. 1602 By: Walke, West (Josh),
Phillips, Talley, Moore,
Davis, Mize, Luttrell,
Townley, Bashore, Sims,
Pae, Fetgatter, Lawson,
Blancett, McDugle, Munson,
West (Tammy), Cornwell ,
Manger, Roberts (Eric),
Wolfley, Boles, Kerbs,
Dollens, Ranson, Randleman,
Roe, Brewer, Cruz, Boatman,
McEntire, Waldron, Conley,
Rosecrants, Wallace,
Virgin, Provenzano,
Hilbert, Fugate and
Caldwell (Trey) of the
House
and
Montgomery, Hicks, Dossett
(J.A.) and Kidd of the
Senate
An Act relating to privacy of computer data; enacting
the Oklahoma Computer Data Privacy Act; defining
terms; providing that this act applies to certain
businesses that collect consumers ' personal
information; providing exemptions; prescribing
compliance with other laws and legal proceedings;
requiring this act to be liberally construed to align
its effects with other laws relating to privacy and
protection of personal information; providing that
when in conflict federal law controls; providing that
when in conflict with sta te law the law providing the
greatest privacy or protection to consumers controls;
providing for preemption of local law ; providing
consumers the right to request disclosure of certain
information; providing consumers the right to request
the deletion of their information; providing
consumers the right to request and receive a
disclosure of personal information sold or disclosed;
providing consumers the right to opt in and out of
ENGR. H. B. NO. 1602 Page 2 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
the sale of their personal information; find ing that
individuals in Oklahoma h ave a right to prohibit
retention, use or disclosure of their own personal
data; finding that Oklahomans have been exploited for
monetary gain and manipulation by private ventures in
utilization of private data; find ing that the
protection of individuals ' data is a core
governmental function in orde r to protect the health,
safety and welfare of individuals in Oklahoma;
finding that this act is the least restrictive
alternative necessary to protect individuals and
their rights; finding that the use of a stri ctly
"opt-out" method for data privacy is ineffectual and
poses an immediate risk to health, safety and welfare
of Oklahomans; providing that contracts or other
agreements purporting to waive or limit a right,
remedy or means of enforcement are contrary to public
policy and are void; requiring that businesses
collecting consumer data information must inform the
consumer of each category of personal information
collected and for which purpose the information will
be used, and obtain the consumer 's explicit consent;
requiring businesses that collect, sell, or for a
business purpose disclose consumer s' personal
information to provide an online privacy policy or a
notice of the business 's policies; requiring
businesses to designate and make available methods
for submitting a verifiable consumer request for
information that is required to be disclosed or
deleted; requiring business es receiving consumer
requests to promptly take steps to reasonably verify
the identity of the requesting consumers; requiring
businesses that receive a verifiable consumer request
within a certain timeframe disclose the required
information; requiring businesses that use de-
identified information to not re -identify or attempt
to re-identify a consumer who is the subject of de-
identified information without obtaining permission;
providing that business es may not discriminate
against consumers for exercising their rights;
providing that business es may offer a financial
incentive to consumers for the collection, sale or
disclosure of their p ersonal information; providing
that businesses may not divide a single transaction
into more than one transaction with the intent to
avoid the requirements of this act; requiring
businesses to ensure employees hand ling consumer
ENGR. H. B. NO. 1602 Page 3 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
inquiries about privacy prac tices are informed of
certain rights, requirements and information;
providing civil penalties; authorizing the Oklahoma
Attorney General to take certain actions against
violating businesses; authorizing the Attorney
General to recover reasonable expenses i ncurred in
obtaining injunctive relief or civil penalties;
directing the Attorney General to deposit collected
penalties in a dedicated account in the General
Revenue Fund; providing certain immunities; providing
protections to service providers; providing for
codification; and providing an effective date.
BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
SECTION 1. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 of Title 17, unless the re
is created a duplication in numbering, reads as follows:
This act shall be known and may be cited as the "Oklahoma
Computer Data Privacy Act ".
SECTION 2. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Sec tion 901.2 of Title 17, unless there
is created a duplication in numbering, reads as follows:
As used in this act:
1. "Aggregate consumer information " means information that
relates to a group or category of consumers from which individual
consumer identities have been removed and that is not linked or
reasonably linkable to a particular consumer or household, including
ENGR. H. B. NO. 1602 Page 4 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
through a device. The term does not include one or more individual
consumer records that have been de -identified;
2. "Biometric information" means an individual's physiological,
biological or behavioral characteristics that can be used, alone or
in combination with other characteristics or other identifying data,
to establish the individual 's identity. The term includes:
a. deoxyribonucleic acid (DNA),
b. an image of an iris, retina , fingerprint, face, hand,
palm or vein pattern or a voice recording from which
an identifier template can be extracted such as a
faceprint, minutiae template or voiceprint,
c. keystroke patterns or rhythms,
d. gait patterns or rhythms, and
e. sleep, health or exercise data that contains
identifying information ;
3. "Business" means a for-profit entity, including a sole
proprietorship, partnership, limited liability company, cor poration,
association or other legal entity that is organized or operated for
the profit or financial benefit of the entity 's shareholders or
other owners, but does not include I nternet service providers so
long as they are acting in their role as I nternet service providers;
4. "Business purpose" means the use of personal information
for:
ENGR. H. B. NO. 1602 Page 5 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
a. the following operational purposes of a business or
service provider, provided that the use of the
information is reasonably necessary and proportionate
to achieve the operational purpose for which the
information was collected or processed or another
operational purpose that is compatible with the
context in which the information was collected:
(1) auditing related to a current interaction with a
consumer and any concurrent transactions,
including counting ad impressions to unique
visitors, verifying the positioning and quality
of ad impressions, and auditing compliance with a
specification or other standards for ad
impressions,
(2) detecting a security incident, protecting against
malicious, deceptive, fraudulent or illegal
activity, and prosecuting those responsible for
any illegal activity described by this division,
(3) identifying and repairing or removing errors that
impair the intended functionality of computer
hardware or software,
(4) using personal information in the short term or
for a transient use, provided that the
information is not:
ENGR. H. B. NO. 1602 Page 6 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(a) disclosed to a third party, and
(b) used to build a profile about a consumer or
alter an individual consumer 's experience
outside of a current interaction w ith the
consumer, including the contextual
customization of an advertisement displayed
as part of the same interaction,
(5) performing a service on behalf of the business or
service provider, including:
(a) maintaining or servicing an account,
providing customer service, processing or
fulfilling an order or transaction,
verifying customer information, processing a
payment, providing financing, providing
advertising or marketing services, or
providing analytic services, or
(b) performing a service similar to a service
described by subdivision (a) of this
division on behalf of the business or
service provider,
(6) undertaking internal research for technological
development and demonstration,
(7) undertaking an activity to:
ENGR. H. B. NO. 1602 Page 7 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(a) verify or maintain the qualit y or safety of
a service or device that is owned by,
manufactured by, manufactured for or
controlled by the business, or
(b) improve, upgrade or enhance a service or
device described by subdivision (a) of this
division, or
(8) retention of employment date, or
b. another operational purpose for wh ich notice is given
under this act, but specifically excepting cross -
context targeted advertising, unless the customer has
opted in to the same ;
5. "Collect" means to buy, rent, gather, obtain, receive or
access the personal information of a consumer by any means,
including by actively or passively receiving the information from
the consumer or by observing the consumer 's behavior;
6. "Commercial purpose" means a purpose that is intended to
result in a profit or ot her tangible benefit or the advancement of a
person's commercial or economic interests, such as by inducing
another person to buy, ren t, lease, subscribe to, provide or
exchange products, goods, property, information or services or by
enabling or effecting , directly or indirectly, a commercial
transaction. The term does not include the purpose of engaging in
ENGR. H. B. NO. 1602 Page 8 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
speech recognized by state or federal courts as noncommercial
speech, including political speech and journalism ;
7. "Consumer" means an individual who is a resident of this
state;
8. "De-identified information " means information that cannot
reasonably identify, relate to, describe, be associated with, or be
linked to, directly or indirectly, a particular consumer ;
9. "Device" means any physical objec t capable of connecting to
the Internet, directly or indirectly, or to another device ;
10. "Identifier" means data elements or other information that
alone or in conjunction with other information can be used to
identify a particular consumer, household or device that is linked
to a particular consumer or household;
11. "Internet service provider" means a person who provides a
mass-market retail service by wire or radio that provides the
capability to transmit data and to receive data from all or
substantially all Internet endpoints, including any capabilities
that are incidental to and enable the operations of the service,
excluding dial-up Internet access service ;
12. "Person" means an individual, sole proprietorship, firm,
partnership, joint venture, s yndicate, business trust, company,
corporation, limited liability company, association, committee and
any other organization or gro up of persons acting in concert;
ENGR. H. B. NO. 1602 Page 9 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
13. "Personal information " means information that identifies,
relates to, describes, can be associated with or can reasonably be
linked to, directly or indirectly, a particular consumer or
household. The term includes the following categories of
information if the information identifies, relates to, de scribes,
can be associated with or can reasonably be linked to, directly or
indirectly, a particular consumer or household:
a. an identifier, including a real name, alias, mailing
address, account name, date of birth, driver license
number, unique identifier, Social Security number,
passport number, signature, telephone number or other
government-issued identification number, or other
similar identifier,
b. an online identifier, including an electronic mail
address or Internet Protocol address, or other similar
identifier,
c. a physical characterist ic or description, including a
characteristic of a protected classification under
state or federal law,
d. commercial information, including:
(1) a record of personal property,
(2) a good or service purchased, obtained or
considered,
(3) an insurance policy number, or
ENGR. H. B. NO. 1602 Page 10 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(4) other purchasing or consuming histories or
tendencies,
e. biometric information,
f. Internet or other electronic network activity
information, including:
(1) browsing or search history, and
(2) other information regarding a consumer 's
interaction with an Internet website, application
or advertisement,
g. geolocation data,
h. audio, electronic, visua l, thermal, olfactory or other
similar information,
i. professional or employment -related information,
j. education information that is not publ icly available
personally identifiable information under the federal
Family Educational Rights and Privacy Act of 1974,
k. financial information, including a financial
institution account number, credit or debit card
number, or password or access code asso ciated with a
credit or debit card or bank account,
l. medical information,
m. health insurance information, or
n. inferences drawn from any of the information listed
under this paragraph to create a profile about a
ENGR. H. B. NO. 1602 Page 11 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
consumer that reflects the consumer 's preferences,
characteristics, psychological trends,
predispositions, behavior, att itudes, intelligence,
abilities or aptitudes;
14. "Processing information " means performing any operation or
set of operations on personal data or on sets of personal data,
whether or not by automated means;
15. "Publicly available information " means information that is
lawfully made available to the public from federal, state or local
government records or information received from widely distributed
media or by the consumer in the public domain . The term does not
include:
a. biometric information of a consumer collected by a
business without the consumer 's knowledge or consent,
or
b. de-identified or aggregate consu mer information;
16. "Service provider" means a for-profit entity as described
by paragraph 3 of this section that processes information on behalf
of a business and to which the business discloses, for a business
purpose, a consumer's personal information under a written contract,
provided that the contract prohib its the entity receiving the
information from retaining, using or disclosing the information for
any purpose other than:
ENGR. H. B. NO. 1602 Page 12 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
a. providing the services specified in the contract with
the business, or
b. for a purpose permitted by this act, including for a
commercial purpose other than pro viding those
specified services;
17. "Third party" means a person who is not:
a. a business to which this act applies that collects
personal information from consumers, or
b. a person to whom the business discloses, for a
business purpose, a consumer 's personal information
under a written contract, provided that the contract:
(1) prohibits the person receiving the information
from:
(a) selling the information,
(b) retaining, using or disclosing the
information for any purpose ot her than
providing the services specified in the
contract, including for a commercial purpose
other than providing those services, and
(c) retaining, using or disclosing the
information outside of the direct business
relationship between the person and the
business, and
ENGR. H. B. NO. 1602 Page 13 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(2) includes a certification made by the person
receiving the personal information that the
person understands and will comply with the
prohibitions under division (1) of this
subparagraph;
18. "Unique identifier" means a persistent identif ier that can
be used over time and across different services to recognize a
consumer, a custodial parent or guardian, or any minor children over
which the parent or guardian has custody, or a device that is linked
to those individuals. The term includes:
a. a device identifier,
b. an Internet Protocol address,
c. a cookie, beacon, pixel tag, mobile ad id entifier or
similar technology,
d. a customer number, unique pseudonym or user alias,
e. a telephone number, and
f. another form of a persistent or probabi listic
identifier that can be used to identify a particular
consumer or device;
19. "Verifiable consumer request " means a request:
a. that is made by a consumer, a consumer on behalf of
the consumer's minor child, or a natural person or
person who is authorized by a consumer to act on the
consumer's behalf, and
ENGR. H. B. NO. 1602 Page 14 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
b. that a business can reasonably verify, in accordance
with Section 19 of this act, was submitted by the
consumer about whom the business has collected
personal information; and
20. "Consent" means an act that clearly and conspicuously
communicates the individual's authorization of an act or pra ctice
that is made in the absence of any mechanism in the user interface
that has the purpose or substantial effect of obscuring, subverting
or impairing decision-making or choice to obtain consent.
SECTION 3. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.3 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. This act applies only to:
1. A business that:
a. does business in this state,
b. collects consumers' personal information or has that
information collected on the business 's behalf,
c. alone or in conjunction with others, determines the
purpose for and means o f processing consumers '
personal information, and
d. satisfies one or more of the following thresholds:
(1) has annual gross revenue in an amount that
exceeds Ten Million Dollars ($10,000,000.00),
ENGR. H. B. NO. 1602 Page 15 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(2) alone or in combination wi th others, annually
buys, sells or receives or shares for commercial
purposes the personal information of fifty
thousand or more consumers, households or
devices, or
(3) derives twenty-five percent (25%) or more of the
business's annual revenue from selling consumers '
personal information; and
2. An entity that controls or is controlled by a business
described by paragraph 1 of this subsection and that shares the same
or substantially similar brand name and/or common database for
consumers' personal information. For purposes of this paragraph,
"control" means the:
a. ownership of, or power to vote, more than fifty
percent (50%) of the outstanding shares of any class
of voting security of a business ,
b. control in any manner over the election of a majority
of the directors or of indivi duals exercising similar
functions, or
c. power to exercise a controlling influence over the
management of a company.
B. For purposes of this ac t, a business sells a consumer 's
personal information to another business or a third party if the
business sells, rents, discloses, dissemina tes, makes available,
ENGR. H. B. NO. 1602 Page 16 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
transfers or otherwise communicates, orally, in writing, or by
electronic or other means, the information to the other business or
third party for monetary or other valuable consideration.
C. For purposes of this act, a business does not sell a
consumer's personal information if:
1. The consumer directs the business to intentionally disclose
the information or uses the business to intentionally interact with
a third party, provided that the third party d oes not sell the
information, unless that disc losure is consistent with this a ct; or
2. The business:
a. uses or shares an identifier of the consumer to alert
a third party that the consumer has opted out of the
sale of the information,
b. uses or shares with a service provider a consumer 's
personal information that is necessary to perform a
business purpose if:
(1) the business provided notice that the information
is being used or shared in the business 's terms
and conditions consistent with Sections 1 3 and 17
of this act, and
(2) the service provider does not further collect,
sell or use the information except as necessary
to perform the business purpose, or
ENGR. H. B. NO. 1602 Page 17 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
c. transfers to a third party a consumer 's personal
information as an asset that is part of a merger,
acquisition, bankruptcy or other transaction in which
the third party assumes control of all or part of the
business, provided that information is used or sh ared
consistent with this act .
D. For purposes of paragraph 1 of subsection C of this section ,
an intentional interaction occurs if the consumer does one or more
deliberate acts with the intent to interact with a third party.
Placing a cursor over, muting, pausing or closing online content
does not constitute a consumer 's intent to interact with a third
party. Instead, said deliberate act must be consent to such
interaction as defined herein.
SECTION 4. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.4 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. This act does not apply to:
1. Publicly available information;
2. Medical information governed by state privacy health laws or
protected health information that is collected by a covered entity
or business associate governed by the privacy, security and data
breach notification rules issued by the United States Department of
Health and Human Services, Parts 160 and 164 of Title 45 of the Code
of Federal Regulations, established pursuant to the federal Hea lth
ENGR. H. B. NO. 1602 Page 18 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
Insurance Portability and Accountability Act of 1996 (Public Law
104-191) and the federal Health Information Technology for Economic
and Clinical Health Act, Title XIII of the federal American Recovery
and Reinvestment Act of 2009 (Public Law 111 -5);
3. A provider of health care , or a health plan, governed by
state privacy health laws or a covered entity go verned by the
privacy, security and data breach notification rules issued by the
United States Department of Health and Human Services, Parts 160 an d
164 of Title 45 of the Code of Federal Regulations, established
pursuant to the federal Health Insurance Portability and
Accountability Act of 1996 (Public Law 104 -191), to the extent the
provider or covered entity maintains, uses and discloses patient
information in the same manner as medical information or protected
health information as described in paragraph 2 of this subsection;
4. A business associate of a covered entity go verned by the
privacy, security and data breach notification rules issued by the
United States Department of Health and Human Services, Parts 160 and
164 of Title 45 of the Code of Federal Regulations, established
pursuant to the federal Health Insurance Portability and
Accountability Act of 1996 (Public Law 104 -191) and the federal
Health Information Technology for Economic and Clinical Health Act,
Title XIII of the federal American Recovery and Reinvestment Act of
2009 (Public Law 111 -5), to the extent that the bus iness associate
maintains, uses and discloses patient information in the same manner
ENGR. H. B. NO. 1602 Page 19 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
as medical information or protected health information as described
in paragraph 2 of this subsection;
5. Information that meets both of the following conditions:
a. is de-identified in accordance with the requirements
for de-identification set forth in Section 164.514 of
Part 164 of Title 45 of the Code of Federal
Regulations, and
b. is derived from patient information that was
originally collected, created, transmitted or
maintained by an entity regulated by the Health
Insurance Portability and Accountability Act of 1996
or the Federal Policy for the Protection of Human
Subjects, also known as the Common Rule.
Information that meets the requirements of subparagraph a or b
of this paragraph but is subsequently re -identified shall no lon ger
be eligible for the exemption in this paragraph and shall be subject
to applicable federal and state data privacy and security laws,
including, but not limited to, the Health Insurance Portability and
Accountability Act of 1996 and state medical privac y laws;
6. Information that is collected, used or disclosed in
research, as defined in Section 164.501 of Title 45 of the Code of
Federal Regulations, including, but not limited to, a clinical
trial, and that is conducted in accordance with applicable e thics,
confidentiality, privacy and security rules of Part 164 of Title 45
ENGR. H. B. NO. 1602 Page 20 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
of the Code of Federal Regulations, the Federal Policy for the
Protection of Human Subjects, also known as the Common Rule, good
clinical practice guidelines issued by the Internation al Council for
Harmonisation, or human subject protection requirements of the
United States Food and Drug Administration;
7. The sale of personal information t o or by a consumer
reporting agency if the information is to be:
a. reported in or used to gener ate a consumer report, as
defined by Section 1681a(d) of the Fair Credit
Reporting Act (15 U.S.C., Section 1681 et seq.), and
b. used solely for a purpose authorized under that act;
8. Personal information collected, processed, sold or disclosed
in accordance with:
a. the federal Gramm-Leach-Bliley Act of 1999 (Public Law
106-102) and its implementing regulations, or
b. the federal Driver's Privacy Protection Act of 1994
(18 U.S.C., Section 2721 et seq.);
9. De-identified or aggregate consumer information ; or
10. A consumer's personal information collected or sold by a
business, if every aspect of the collection or sale occurred wholly
outside of this state.
Provided further, nothing in this a ct shall be deemed to apply
in any manner to a financial instit ution or an affiliate of a
ENGR. H. B. NO. 1602 Page 21 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
financial institution that is subject to the federal Gramm -Leach-
Bliley Act of 1999 and the rules promulgated thereunder.
B. For the purposes of this section, a business or other person
shall not re-identify, or attempt to re -identify, information that
has met the requirements of paragraphs 2 through 6 of subsection A
of this section, except for one or more of the following purposes:
1. Treatment, payment or health care operations conducted by a
covered entity or business associ ate acting on behalf of, and at the
written direction of, the covered entity. For purposes of this
paragraph, "treatment", "payment", "health care operations" and
"covered entity" have the same meaning as defined in Section 164.501
of Title 45 of the Code of Federal Regulations, and "business
associate" has the same meaning as defined in Section 160.103 of
Title 45 of the Code of Federal Regulations;
2. Public health activities or purposes as described in Section
164.512 of Title 45 of the Code of Federal Regulations;
3. Research, as defined in Section 164.501 of Title 45 of the
Code of Federal Regulations, that is conducted in accordance with
Part 46 of Title 45 of the Code of Federal Regulations and the
Federal Policy for the Protection of Human Subject s, also known as
the Common Rule;
4. Pursuant to a contract where the lawful holder of the de -
identified information expressly engages a person or entity to
attempt to re-identify the de-identified information in order to
ENGR. H. B. NO. 1602 Page 22 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
conduct testing, analysis, or val idation of de-identification, or
related statistical techniques, if the contract bans any other use
or disclosure of the re -identified information and requires the
return or destruction of the information that was re -identified upon
completion of the contr act; and
5. If otherwise required by law.
C. In accordance with paragraphs 2 through 6 of subsection A of
this section, information re-identified pursuant to this section
shall be subject to applicable federal and state data privacy and
security laws, including, but not limited to, the Health Insurance
Portability and Accountability Ac t of 1996 and state health privacy
laws.
D. Beginning January 1, 2023, any contract for the sale or
license of de-identified information that has met the requirements
of paragraphs 2 through 6 of subsection A of this section , where one
of the parties is a person residing or doing business in the state,
shall include the following, or substantially similar, provisions:
1. A statement that the de -identified information being sold or
licensed includes de-identified patient information;
2. A statement that re-identification, and attempted re -
identification, of the de -identified information by the purchaser or
licensee of the information is proh ibited pursuant to this section;
and
ENGR. H. B. NO. 1602 Page 23 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
3. A requirement that, unless otherwise required by law, the
purchaser or licensee of the de -identified information may not
further disclose the de -identified information to any third party
unless the third party is contractually bound by the same or
stricter restrictions and conditions.
E. For purposes of this section, "re -identify" means the
process of reversal of de -identification techniques, including, but
not limited to, the addition of specific pieces of information or
data elements that can, ind ividually or in combination, be used to
uniquely identify an individual or usage.
F. For purposes of paragraph 10 of s ubsection A of this
section, the collection or sale of a consumer 's personal information
occurs wholly outside of this state if:
1. The business collects that information while the consumer is
outside of this state;
2. No part of the sale of the information occurs in this state;
and
3. The business does not sell any personal information of the
consumer collected while the consumer is in this state.
G. For purposes of subsection F of this section, the collection
or sale of a consumer 's personal information does not occur wholly
outside of this state if a business stores a consumer 's personal
information, including on a device, when the co nsumer is in this
ENGR. H. B. NO. 1602 Page 24 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
state and subsequently collects or sells that stored information
when the consumer and the information are outside of this state.
H. For purposes of this section, all of the following shall
apply:
1. "Business associate" has the same meaning as defined in
Section 160.103 of Title 45 of the Code of Federal Regulations;
2. "Covered entity" has the same meaning as defined in Section
160.103 of Title 45 of the Code of Federal Regulations;
3. "Identifiable private information" has the same meaning as
defined in Section 46.102 of Title 45 of the Code of Federal
Regulations;
4. "Individually identifiable health information" has the same
meaning as defined in Section 160.103 of Title 45 of the Code of
Federal Regulations;
5. "Medical informat ion" means any individually identifiable
information, in electronic or physical form, in possession of or
derived from a provider of health care, health care service plan,
pharmaceutical company, or contractor regarding a patient' s medical
history, mental or physical condition, or treatment;
6. "Patient information" means identifiable private
information, protected health information individually identifiable
health information, or medical information;
ENGR. H. B. NO. 1602 Page 25 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
7. "Protected health information" has the same meaning as
defined in Section 160.103 of Title 45 of the Code of Federal
Regulations; and
8. "Provider of health care" means a person or entity that is a
covered entity.
SECTION 5. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.5 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A right or obligation under this a ct does not apply to the
extent that the exercise of the right or performance of the
obligation infringes on a noncommercial activity of:
1. A publisher, editor, reporter or other person connected with
or employed by a newspaper, magazine or other publication of general
circulation, including a periodical newsletter, pamphlet or report;
2. A radio or television station that holds a license issued by
the Federal Communications Commission ; or
3. An entity that provides an information service, including a
press association or wire service.
SECTION 6. NEW LAW A new section of law to be codif ied
in the Oklahoma Statutes as Section 901.6 of Title 17, unless there
is created a duplication in numbering, reads as follows:
This act does not:
1. Restrict a business 's ability to:
a. comply with:
ENGR. H. B. NO. 1602 Page 26 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
(1) applicable federal, state or local laws, or
(2) a civil, criminal or regulatory inquiry,
investigation, subpoena or summons by a federal,
state or local authority,
b. cooperate with a law enforcement agency concerning
conduct or activity that the business, a s ervice
provider of the business or a third party reasonably
and in good faith believes may violate other
applicable federal, state or local laws,
c. pursue or defend against a legal claim,
d. detect a security incident; protect against malicious,
deceptive, fraudulent or illegal activity; or
prosecute those responsible for any illegal activ ity
described by this paragraph, or
e. assist another party with any of the foregoing; or
2. Require a business to violate an evidentiary privilege under
federal or state law or prevent a business from disclosing to a
person covered by an evidentiary privilege the personal information
of a consumer as part of a privileged communication.
SECTION 7. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.7 of Title 17 , unless there
is created a duplication in numbering, reads as follows:
ENGR. H. B. NO. 1602 Page 27 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
A. This act shall be liberally construed to effect its purposes
and to harmonize, to the extent possible, with other laws of this
state relating to the privacy or protection of person al information.
B. To the extent of a confli ct between a provision of this a ct
and a provision of federal law, including a regulation or an
interpretation of federal law, federal law controls and conflicting
requirements or other provisions of this a ct do not apply. Further,
should the federal government pass comprehensive data privacy
regulations that conflict with the provisions herein, federal law
shall prevail.
C. To the extent of a conflict between a provision of this act
and another statute of this state with respect to the privacy or
protection of consumers ' personal information, the provision of law
that affords the greatest privacy or protection to consumers
prevails.
SECTION 8. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.8 of Title 17, unless there
is created a duplication in numbering, reads as follows:
This act preempts and supersedes any ordinance, order or rule
adopted by a political subdivision of this state relating to the
collection or sale by a business of a consumer 's personal
information.
ENGR. H. B. NO. 1602 Page 28 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 9. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901. 9 of Title 17, unless there
is created a duplication in numbering, rea ds as follows:
Except as used in Section 4 of this act, for purposes of this
act, "research" means scientific, systematic study and observation,
including basic research or applied research that is in the public
interest and that adheres to all other appli cable ethics and privacy
laws or studies conducted in the public interest in the area of
public health. Research with personal information that may have
been collected from a consumer in the course of the consumer 's
interactions with a business 's service or device for other purposes
must:
1. Be compatible with the business purpose for which the
personal information was collected;
2. Be subsequently pseudonymized and de -identified, or de-
identified and in the aggregate, such that the information cannot
reasonably identify, relate to, describe, be capable of being
associated with, or be linked, directly or indirectly, to a
particular consumer;
3. Be made subject to technical safeguards that prohibit re -
identification of the consumer to whom the information may pertain;
4. Be subject to business processes that specifically prohibit
re-identification of the information;
ENGR. H. B. NO. 1602 Page 29 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
5. Be made subject to business processes to prevent inadvertent
release of de-identified information;
6. Be protected from any re -identification attempts;
7. Be used solely for research purposes that are compatible
with the context in which the personal information was collected;
8. Not be used for any commercial purpose; and
9. Be subjected by the business conducting the research to
additional security controls that limit access to the research data
to only those individuals in a business as are necessary to carry
out the research purpose.
SECTION 10. NEW LAW A new section of law to be codified
in the Oklahoma Statu tes as Section 901.1 0 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A consumer is entitled to request that a business that
collects the consumer 's personal information disclose to the
consumer the categories and spe cific items of personal information
the business has collected.
B. To receive the disclosure of information under subsection A
of this section, a consumer must submit to the business a verifiable
consumer request using a method designated by the business under
Section 18 of this act.
C. On receipt of a verifiable consumer request under this
section, a business shall disclose to the consumer in the time and
manner provided by Section 20 of this act:
ENGR. H. B. NO. 1602 Page 30 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1. Each enumerated category and item within each categor y of
personal information under paragraph 13 of Section 2 of this act
that the business collected about the consumer during the twelve
(12) months preceding the date of the request;
2. Each category of sources from which the information was
collected;
3. The business or commercial purpose for collecting or selling
the personal information; and
4. Each category of third parties with whom the business shares
the personal information.
D. This section does not require a business to:
1. Retain a consumer 's personal information that was collected
for a one-time transaction if the information is not sold or
retained in the ordinary course of business; or
2. Re-identify or otherwise link any data that, in the ordinary
course of business, is not maintained in a manner that would be
considered personal information.
SECTION 11. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 1 of Title 17, unless there
is created a duplication in numbering, reads as follo ws:
A. A consumer is entitled to request that a business that
collects the consumer 's personal information delete any personal
information the business has collected from the consumer by
ENGR. H. B. NO. 1602 Page 31 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
submitting a verifiable consumer request using a method designated
by the business under Section 18 of this act .
B. Except as provided by s ubsection C of this section, on
receipt of a verifiable cons umer request under this section, a
business shall delete from the business 's records any personal
information collected from the consumer and direct a service
provider of the business to delete the information from the
provider's records in the time provided for in Section 20 of this
act.
C. A business or service provider of the business is not
required to comply with a verifi able consumer request received under
this section if the business or service provider needs to retain the
consumer's personal information to:
1. Complete the transaction for which the information was
collected;
2. Provide a good or service requested by t he consumer in the
context of the ongoing business relationship between the business
and consumer;
3. Perform under a contract between the business and the
consumer;
4. Detect a security incident; protect against malicious,
deceptive, fraudulent or illegal activity; or prosecute those
responsible for any illegal activity described by this paragraph;
ENGR. H. B. NO. 1602 Page 32 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
5. Identify and repair or remove errors from computer hardware
or software that impair its intended functionality;
6. Exercise free speech or ensure the rig ht of another consumer
to exercise the right of free speech or another right afforded by
law;
7. Comply with a court order or subpoena or other lawful
process; or
8. Engage in public or peer -reviewed scientific, historical or
statistical research that is in the public interest and that adheres
to all other applicable ethics and privacy laws , provided that:
a. the business's deletion of the information is likely
to render impossible or seriously impair the
achievement of that research, and
b. the consumer has previously provided to the business
informed consent to retain the information for such
use.
D. Where a business, service provider or third party has made a
consumer's personal information public, sai d business, service
provider or third party shall:
1. Take all reasonable steps, including technical measures, to
erase the personal information that the business, service provider
or third party made public , taking into account available technology
and the cost of implementation; and
ENGR. H. B. NO. 1602 Page 33 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
2. Advise any other business, service provider or third party
with whom a contract regarding the consumer exists that the consumer
has requested the era sure of any links to, copies of or replication
of that personal information.
SECTION 12. NEW LAW A n ew section of law to be codified
in the Oklahoma Statutes as Section 901.12 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A consumer is entitled to request that a business that
sells, or discloses for a business pur pose, the consumer's personal
information disclose to the consumer:
1. The categories of personal information the business
collected about the consumer;
2. The categories of personal information about the consumer
the business sold, or disclosed for a bu siness purpose; and
3. The categories of third parties to whom the personal
information was sold or disclosed.
B. To receive the disclosure of information under subsection A
of this section, a consumer must submit to the business a verifiable
consumer request using a method designated by the business unde r
Section 18 of this act .
C. On receipt of a verifiable consumer request under this
section, a business shall disclose to the consumer in the time and
manner provided by Section 20 of this act :
ENGR. H. B. NO. 1602 Page 34 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1. Each enumerated category of personal information under
paragraph 13 of Section 2 of this act that the business collected
about the consumer during the twelve (12) months preceding the date
of the request;
2. The categories of third parties to whom the business sold
the consumer's personal information during the twelve (12) months
preceding the date of the request by reference to each enumerated
category of information under paragraph 13 of Section 2 of this act
sold to each third party; and
3. The categories o f third parties to whom the business
disclosed for a business purpose the consumer 's personal information
during the twelve (12) months preceding the date of the request by
reference to each enumerated category of information under paragraph
13 of Section 2 of this act disclosed to each third party.
D. A business shall provide the information described by
paragraphs 2 and 3 of subsection C of this section in two separate
lists.
E. A business that did not sell, or disclose for a business
purpose, the consumer's personal information during the twelve (12)
months preceding the date of receiving the consumer 's verifiable
consumer request under this section shall disclose that fact to the
consumer.
ENGR. H. B. NO. 1602 Page 35 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 13. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 3 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A consumer is entitled at any time to opt out of the sale of
the consumer's personal information by a business to third parties
by directing the business not to sell the information. A consumer
may authorize another person solely to opt out of the sale of the
consumer's personal information on the consumer 's behalf. A
business shall comply with a direction not t o sell that is received
under this subsection.
B. To exercise the right to opt out specified in subsection A
of this section, a consumer shall submit to the business a
verifiable consumer request using a method designated by the
business under Section 18 of this act.
C. A business that sells consumers ' personal information to a
third party shall provide on the business 's Internet website:
1. Notice to consumers that:
a. the information may be sold,
b. identifies the categories of persons to whom the
information will or could be sold, and
c. consumers have the right to opt in to the sale; and
2. A clear and conspicuous link that enables a consumer, or
person authorized by the consumer, to opt in to the sale of the
consumer's personal information.
ENGR. H. B. NO. 1602 Page 36 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
D. A business may not sell to a third party the personal
information of a consumer who does not opt in to the sale of that
information after the effective date of this act or after a consumer
submits a verifiable request to opt out of any future sale .
E. A business may use any personal information collected from
the consumer in connection with the consumer 's opting out under this
section solely to comply with this section.
F. A third party to whom a business has sold the personal
information of a consumer may no t sell the information unless the
consumer receives explicit notice of the potential sale and is
provided the opportunity to, and in fact does, exercise the right to
opt in to the sale as provided by this section.
G. A business may not require a consumer to create an account
with the business to opt in to the sale of the consumer 's personal
information.
H. A business or service provider shall implement and maintain
reasonable security procedures and practices, including
administrative, physical and techni cal safeguards appropriate to the
nature of the information and the purposes for which the personal
information will be used, to protect consumers' personal information
from unauthorized use, disclosure, access, destruction or
modification, irrespective of whether a customer has opted in or out
of a sale of data.
ENGR. H. B. NO. 1602 Page 37 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 14. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 4 of Title 17, unless there
is created a duplication in numbering, reads as f ollows:
A. The Legislature of the State of Oklahoma finds that
individuals within Oklahoma have a r ight to prohibit retention, use
or disclosure of their own personal data.
B. The Legislature of the State of Oklahoma further finds that
individuals within Oklahoma have previously been exploited for
monetary gain and manipulation by private ventures in utilization of
private data.
C. The Legislature of the State of Oklahoma further finds that
the protection of individuals within Oklahoma and their data is a
core governmental function in orde r to protect the health, safety
and welfare of individuals within Oklahoma.
D. The Legislature of the State of Oklahoma further finds that
the terms and conditions set forth in this a ct are the least
restrictive alternative necessary to protect individuals within
Oklahoma and their rights and that the use of a strictly "opt-out"
method for data privacy is ineffectual and poses an immed iate risk
to the health, safety and welfare of individuals within Oklahoma.
SECTION 15. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 5 of Title 17, unless there
is created a duplication in numbering, reads as follows:
ENGR. H. B. NO. 1602 Page 38 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
A. A provision of a contract or other agreement that purports
to waive or limit a right, remedy or m eans of enforcement under this
act is contrary to public policy and is void.
B. This section does not prevent a consumer from:
1. Declining to request information from a business;
2. Declining to opt in to a business's sale of the consumer 's
personal information; or
3. Authorizing a business to sell the consumer 's personal
information after previously opting out.
SECTION 16. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.16 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. After the effective date of this act, a business shall not
collect a consumer's personal information directly from the consumer
prior to notifying the consumer of each category of personal
information to be collected and for what purposes information will
be used, as well as obtaining the consumer's consent, which may be
provided electronically by the consumer, to collect a consumer 's
personal information.
B. A business may not collect an additional category of
personal information directly from the consumer or use personal
information collected for an additional purpose unless the business
provides notice to the consumer of the additional category or
purpose in accordance with s ubsection A of this section.
ENGR. H. B. NO. 1602 Page 39 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
C. If a third party that assumes control of all or part of a
business as described by subparagraph c of paragraph 2 of subsection
C of Section 3 of this act materially alters the practices of the
business in how personal information is used or shared, and the
practices are materially inconsistent with a notice provided to a
consumer under subsection A or B of this section, the third party
must notify the consumer of the third party 's new or changed
practices in a conspicuous manner that allows the consumer to easily
exercise a right provided under this act before the third party uses
or shares the personal information.
D. Subsection C of this section does not authorize a business
to make a material, r etroactive change or other change to a
business's privacy policy in a manner that would be a deceptive
trade practice actionable under Oklahoma law.
SECTION 17. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.17 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A business that collects, sells or for a business purpose
discloses a consumer 's personal information shall disclose the
following information in the busi ness's online privacy policy or
other notice of the business 's policies:
1. A description of a consumer 's rights under Sections 10 , 11,
12, 13 and 16 of this act and designated methods for submitting a
verifiable consumer request under this act;
ENGR. H. B. NO. 1602 Page 40 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
2. For a business that collects personal information about
consumers, a description of the consumer 's right to request the
deletion of the consumer 's personal information;
3. Separate lists containing the categories of consumers '
personal information described by paragraph 13 of Section 2 of this
act that, during the twelve (12) months preceding the date the
business updated the information as required by subsection C of this
section, the business:
a. collected,
b. sold, if applicable, or
c. disclosed for a busine ss purpose, if applicable ;
4. The categories of sources from which the information under
paragraph 3 of this subsection is collected;
5. The business or commercial purposes for collecting personal
information;
6. If the business does not sell consumers ' personal
information or disclose the information for a business or commercial
purpose, a statement of that fact;
7. The categories of third parties to whom the business sells
or discloses personal information;
8. If the business sells consumers ' personal information, the
Internet link required by subsection C of Section 13 of this act ;
and
ENGR. H. B. NO. 1602 Page 41 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
9. If applicable, the financial incentives offer ed to consumers
under Section 23 of this act .
B. If a business described by subsection A of this section does
not have an online privacy policy or other notice of the business 's
policies, the business shall make the information required under
subsection A of this section available to consumers on the
business's Internet website or another website the business
maintains that is dedicated to consumers in this state.
C. A business must update the information required by
subsection A of this section at least once each year.
SECTION 18. NEW LAW A new section of law to be codified
in the Oklahoma Statute s as Section 901.18 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A business shall designate and make available to consumers,
in a form that is reasonably accessible, at least two methods for
submitting a verifiable consumer request for information required to
be disclosed or deleted under this a ct. The methods must include,
at a minimum:
1. A toll-free telephone number that a consumer may call to
submit the request; and
2. The business's Internet website at which the consumer may
submit the request.
B. The methods designated under subsection A of this section
may also include:
ENGR. H. B. NO. 1602 Page 42 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
1. A mailing address;
2. An electronic mail address; or
3. Another Internet webpage or portal .
C. A business may not require a consume r to create an account
with the business to submit a verifiable consumer request.
SECTION 19. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901. 19 of Title 17, unless there
is created a duplication i n numbering, reads as follows:
A. A business that receives a verifiable consumer request under
Section 10, 11, 12 or 13 of this act shall promptly take steps to
reasonably verify that:
1. The consumer who is the subject of the request is a consumer
about whom the business has collected, sold, or for a business
purpose disclosed personal information; and
2. The request is made by:
a. the consumer,
b. a consumer on behalf of the consumer 's minor child, or
c. a person authorized to act on the consumer 's behalf.
B. A business may use any personal information collected from
the consumer in connection with the business 's verification of a
request under this section solely to verify the request.
C. A business that is unable to verify a consumer request under
this section is not required to comply with the request.
ENGR. H. B. NO. 1602 Page 43 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 20. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 0 of Title 17, unless there
is created a duplication in numbering, reads as foll ows:
A. Not later than forty-five (45) days after the date a
business receives a verifiable consume r request under Section 10,
11, 12 or 13 of this act , the business shall disclose free of charge
to the consumer the information required to be disclosed un der those
sections or take the requested actions, as applicable .
B. A business may extend the time in which to comply with
subsection A of this section once by an additional forty-five (45)
days if reasonably necessary or by an additional ninety (90) days
after taking into account the number and complexity of verifiable
consumer requests received by the business. A business that extends
the time in which to comply with subsection A of this section shall
notify the consumer of the extension and reason for the delay within
the period prescribed by that subsection.
C. The disclosure required by subsection A of this section
must:
1. Cover personal information collected, sold or disclosed for
a business purpose, as applicable, during the twelve (12) months
preceding the date the business receives the request; and
2. Be made in writing and delivered to the consumer:
ENGR. H. B. NO. 1602 Page 44 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
a. by mail or electronically, at the consumer 's option,
if the consumer does not have an account with the
business, or
b. through the consumer 's account with the business.
D. An electronic disclosure under subsection C of this section
must be in a readily accessible format that allows the consumer to
electronically transmit the information to another person or entity.
E. A business is not required to make the disclosure required
by subsection A of this section to the same consumer more than once
in a twelve-month period.
F. Notwithstanding subsection A of this section, if a
consumer's verifiable consumer request is manifestly baseless or
excessive, in particular because of repetitiveness, a business may
charge a reasonable fee after taking into account the administrative
costs of compliance or refusal to comply with the request. The
business has the burden of demonstrating that a request is
manifestly baseless or excessive.
G. A business that does not comply with a consumer 's verifiable
consumer request under subsection A of this section shall notify the
consumer, within the time the business is required to respond to a
request under this section, of the reasons for the refusal and the
rights the consumer may have to appeal that decision.
ENGR. H. B. NO. 1602 Page 45 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 21. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 1 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A business that uses de -identified information may not re -
identify or attempt to re -identify a consumer who is the subject of
de-identified information without obtaining the consumer 's consent
or authorization.
B. A business that uses de -identified information shall
implement:
1. Technical safeguards and business processes to prohibit re -
identification of the consumer to whom the information may pertain;
and
2. Business processes to prevent inadvertent relea se of de-
identified information.
C. This act may not be construed to require a business to re -
identify or otherwise link information that is not maintained in a
manner that would be considered personal information.
SECTION 22. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 2 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A business may not discriminate against a consumer because
the consumer exercised a right under this act, including by:
1. Denying a good or service to the consumer;
ENGR. H. B. NO. 1602 Page 46 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
2. Charging the consumer a different price or rate for a good
or service, including denying the use of a discount or other benefit
or imposing a penalty;
3. Providing a diffe rent level or quality of a good or service
to the consumer; or
4. Suggesting that the consumer will be charged a different
price or rate for, or provided a different level or quality of, a
good or service.
B. This section does not prohibit a business fro m offering or
charging a consumer a different price or rate for a good or service,
or offering or providing to the consumer a different level or
quality of a good or service, if the difference is reasonably
related to the value provided to the consumer by the consumer's
data.
SECTION 23. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 3 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. Subject to subsection B of this section, a business may
offer a financial incentive to a consumer, including a payment as
compensation, for the collection, sale or disclosure of the
consumer's personal information.
B. A business may enroll a customer in a financial incentive
program only if the business provides to the consumer a clear
ENGR. H. B. NO. 1602 Page 47 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
description of the material terms of the program and obtains the
consumer's prior opt-in consent, which:
1. Contains a clear description of those material terms; and
2. May be revoked by the consum er at any time.
C. A business may not use financial incentive practices that
are unjust, unreasonable, coercive or usurious in nature.
SECTION 24. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 4 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A business may not divide a single transaction into more
than one transaction with the intent to avoid the requirements of
this act.
B. For purposes of this a ct, two or more substantially similar
or related transactions are considered a single transaction if the
transactions:
1. Are entered into contemporaneously; and
2. Have at least one common party.
C. A court shall disregard any intermediate transactions
conducted by a business with the intent to avoid the requirements of
this act, including the disclosure of information by a business to a
third party to avoid complying with the requirements under this act
applicable to a sale of the information.
ENGR. H. B. NO. 1602 Page 48 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 25. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 5 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A business shall ensure that each person responsible for
handling consumer inquiries about the business 's privacy practices
or compliance with this act is informed of the requirements of this
act and of how to direct a consumer in exercising any of the rights
to which a consumer is entitled under this a ct.
SECTION 26. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 6 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A. A person who violates this a ct is liable to this state for
injunctive relief and/or a civil penalty in an amount not to exceed:
1. Two Thousand Five Hundred Dollars ($2,500.00) for each
violation; or
2. Seven Thousand Five Hundred Dollars ($7,500.00) for each
violation, if the violation is intentional.
B. The Oklahoma Attorney General is entitled to recover
reasonable expenses, including reasonable attorney fees, court costs
and investigatory costs, incurred in obtaining injunctive relief or
civil penalties, or both, under this section. Amounts collected
under this section shall be deposited in a dedicated account in the
General Revenue Fund and shall be appropriated only for the purposes
of the administration and enforcement of this a ct.
ENGR. H. B. NO. 1602 Page 49 1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
SECTION 27. NEW LAW A new section of law to be codifie d
in the Oklahoma Statutes as Section 901.2 7 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A business that discloses to a third party, or discloses for a
business purpose to a service provider, a consumer 's personal
information in compliance with this a ct may not be held liable for a
violation of this act by the third party or service provider if the
business does not have actual knowledge or a reasonable belief that
the third party or service provider intends to violate this act.
SECTION 28. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 8 of Title 17, unless there
is created a duplication in numbering, reads as follows:
A business's service provider may not be held liable for a
violation of this act by the business.
SECTION 29. This act shall become effective January 1, 2023.
Passed the House of Representatives the 4th day of March, 2021.
Presiding Officer of the House
of Representatives
Passed the Senate the ___ day of __________, 2021.
Presiding Officer of the Senate