| 1 | 1 | | |
|---|
| 2 | 2 | | |
|---|
| 3 | 3 | | |
|---|
| 4 | 4 | | |
|---|
| 5 | 5 | | 2023 -- H 6236 |
|---|
| 6 | 6 | | ======== |
|---|
| 7 | 7 | | LC002702 |
|---|
| 8 | 8 | | ======== |
|---|
| 9 | 9 | | S T A T E O F R H O D E I S L A N D |
|---|
| 10 | 10 | | IN GENERAL ASSEMBLY |
|---|
| 11 | 11 | | JANUARY SESSION, A.D. 2023 |
|---|
| 12 | 12 | | ____________ |
|---|
| 13 | 13 | | |
|---|
| 14 | 14 | | A N A C T |
|---|
| 15 | 15 | | RELATING TO COMMERCI AL LAW -- GENERAL REGULATORY PROVISION S -- |
|---|
| 16 | 16 | | RHODE ISLAND DATA TRANSPARENCY AND PRIVA CY PROTECTION ACT |
|---|
| 17 | 17 | | Introduced By: Representatives Shanley, Edwards, Solomon, Baginski, and |
|---|
| 18 | 18 | | Marszalkowski |
|---|
| 19 | 19 | | Date Introduced: March 30, 2023 |
|---|
| 20 | 20 | | Referred To: House Innovation, Internet, & Technology |
|---|
| 21 | 21 | | |
|---|
| 22 | 22 | | |
|---|
| 23 | 23 | | It is enacted by the General Assembly as follows: |
|---|
| 24 | 24 | | SECTION 1. Title 6 of the General Laws entitled "COMMERCIAL LAW — GENERAL 1 |
|---|
| 25 | 25 | | REGULATORY PROVISIONS" is hereby amended by adding thereto the following chapter: 2 |
|---|
| 26 | 26 | | CHAPTER 48.1 3 |
|---|
| 27 | 27 | | RHODE ISLAND DATA TRANSPARENCY AND PRIVACY PROTECTION ACT 4 |
|---|
| 28 | 28 | | 6-48.1-1. Short title. 5 |
|---|
| 29 | 29 | | This chapter shall be known and may be cited as the "Rhode Island Data Transparency and 6 |
|---|
| 30 | 30 | | Privacy Protection Act." 7 |
|---|
| 31 | 31 | | 6-48.1-2. Legislative findings. 8 |
|---|
| 32 | 32 | | The general assembly hereby finds and declares that: 9 |
|---|
| 33 | 33 | | (1) The right to privacy is a personal and fundamental right protected by the United States 10 |
|---|
| 34 | 34 | | Constitution. As such, all individuals have a right to privacy in information pertaining to them. This 11 |
|---|
| 35 | 35 | | state recognizes the importance of providing customers with transparency about how their 12 |
|---|
| 36 | 36 | | personally identifiable information, especially information relating to their children, is shared by 13 |
|---|
| 37 | 37 | | businesses. This transparency is crucial for Rhode Island citizens to protect themselves and their 14 |
|---|
| 38 | 38 | | families from cyber-crimes and identity thieves. 15 |
|---|
| 39 | 39 | | (2) Furthermore, for free market forces to have a role in shaping the privacy practices and 16 |
|---|
| 40 | 40 | | for "opt-in" and "opt-out" remedies to be effective, customers must be more than vaguely informed 17 |
|---|
| 41 | 41 | | that a business might share personally identifiable information with third parties (as that term is 18 |
|---|
| 42 | 42 | | |
|---|
| 43 | 43 | | |
|---|
| 44 | 44 | | LC002702 - Page 2 of 18 |
|---|
| 45 | 45 | | hereinafter defined). Customers must be better informed about what kinds of personally identifiable 1 |
|---|
| 46 | 46 | | information is shared with other businesses. With these specifics, customers can knowledgeably 2 |
|---|
| 47 | 47 | | choose to opt in, opt out, or choose among businesses that disclose (as that term is hereinafter 3 |
|---|
| 48 | 48 | | defined) personally identifiable information to third parties on the basis of how protective the 4 |
|---|
| 49 | 49 | | business is of customers' privacy. 5 |
|---|
| 50 | 50 | | (3) Businesses are now collecting personally identifiable information and disclosing it in 6 |
|---|
| 51 | 51 | | ways not contemplated or properly covered by the current law. Some websites are installing 7 |
|---|
| 52 | 52 | | tracking tools that record when customers visit webpages, and sending personally identifiable 8 |
|---|
| 53 | 53 | | information, such as age, gender, race, income, health concerns, religion, and recent purchases to 9 |
|---|
| 54 | 54 | | third-party marketers and data brokers. Third-party data broker companies are buying and 10 |
|---|
| 55 | 55 | | disclosing personally identifiable information obtained from mobile phones, financial institutions, 11 |
|---|
| 56 | 56 | | social media sites, and other online and brick and mortar companies. Some mobile applications are 12 |
|---|
| 57 | 57 | | sharing personally identifiable information, such as location information, unique phone 13 |
|---|
| 58 | 58 | | identification numbers, age, gender, and other personal details with third-party companies. 14 |
|---|
| 59 | 59 | | (4) As such, customers need to know the ways that their personally identifiable information 15 |
|---|
| 60 | 60 | | is being collected by companies and then shared or sold to third parties in order to properly protect 16 |
|---|
| 61 | 61 | | their privacy, personal safety, and financial security. 17 |
|---|
| 62 | 62 | | 6-48.1-3. Definitions. 18 |
|---|
| 63 | 63 | | As used in this chapter: 19 |
|---|
| 64 | 64 | | (1) "Affiliate" means any entity that, directly or indirectly, controls, is controlled by, or is 20 |
|---|
| 65 | 65 | | under common control with, the entity that has disclosed personally identifiable information to it. 21 |
|---|
| 66 | 66 | | For this purpose, “control” or “controlled” means ownership of, or the power to vote, more than 22 |
|---|
| 67 | 67 | | fifty percent (50%) of the outstanding shares of any class of voting security of a company, control 23 |
|---|
| 68 | 68 | | in any manner over the election of a majority of the directors or of individuals exercising similar 24 |
|---|
| 69 | 69 | | functions, or the power to exercise controlling influence over the management of a company. 25 |
|---|
| 70 | 70 | | (2) "Authenticate" means to use reasonable means to determine that request to exercise any 26 |
|---|
| 71 | 71 | | of the rights afforded under this chapter is being made by, or on behalf of, the customer who is 27 |
|---|
| 72 | 72 | | entitled to exercise such customer rights with respect to the personal data at issue. 28 |
|---|
| 73 | 73 | | (3) "Biometric data" means data generated by automatic measurements of an individual's 29 |
|---|
| 74 | 74 | | biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique 30 |
|---|
| 75 | 75 | | biological patterns or characteristics that are used to identify a specific individual. "Biometric data" 31 |
|---|
| 76 | 76 | | does not include a digital or physical photograph, an audio or video recording, or any data generated 32 |
|---|
| 77 | 77 | | from a digital or physical photograph, or an audio or video recording, unless such data is generated 33 |
|---|
| 78 | 78 | | to identify a specific individual. 34 |
|---|
| 79 | 79 | | |
|---|
| 80 | 80 | | |
|---|
| 81 | 81 | | LC002702 - Page 3 of 18 |
|---|
| 82 | 82 | | (4) “Business associate” has the same meaning as provided in HIPAA. 1 |
|---|
| 83 | 83 | | (5) “Child” has the same meaning as provided in COPPA. 2 |
|---|
| 84 | 84 | | (6) "Consent" means a clear affirmative act signifying a customer freely given, specific, 3 |
|---|
| 85 | 85 | | informed and unambiguous agreement to allow the processing of personal data relating to the 4 |
|---|
| 86 | 86 | | customer. "Consent" may include a written statement, including by electronic means, or any other 5 |
|---|
| 87 | 87 | | unambiguous affirmative action. "Consent" does not include acceptance of a general or broad term 6 |
|---|
| 88 | 88 | | of use or similar document that contains descriptions of personal data processing along with other, 7 |
|---|
| 89 | 89 | | unrelated information, hovering over, muting, pausing or closing a given piece of content, or 8 |
|---|
| 90 | 90 | | agreement obtained through the use of dark patterns. 9 |
|---|
| 91 | 91 | | (7) "Controller" means an individual who, or legal entity that, alone or jointly with others 10 |
|---|
| 92 | 92 | | determines the purpose and means of processing personal data. 11 |
|---|
| 93 | 93 | | (8) "COPPA" means the Children's Online Privacy Protection Act of 1998, 15 USC 6501 12 |
|---|
| 94 | 94 | | et seq., and the regulations, rules, guidance and exemptions adopted, pursuant to said act, as said 13 |
|---|
| 95 | 95 | | act and such regulations, rules, guidance and exemptions may be amended from time to time. 14 |
|---|
| 96 | 96 | | (9) "Covered entity" has the same meaning as provided in HIPAA. 15 |
|---|
| 97 | 97 | | (10) "Customer" means an individual residing in this state who provides, either knowingly 16 |
|---|
| 98 | 98 | | or unknowingly, personally identifiable information to any entity, with or without an exchange of 17 |
|---|
| 99 | 99 | | consideration, in the course of purchasing, viewing, accessing, renting, leasing, or otherwise using 18 |
|---|
| 100 | 100 | | real or personal property, or any interest therein, or obtaining a product or service, including 19 |
|---|
| 101 | 101 | | advertising or any other content. "Customer" does not include an individual acting in a commercial 20 |
|---|
| 102 | 102 | | or employment context or as an employee, owner, director, officer or contractor of a company, 21 |
|---|
| 103 | 103 | | partnership, sole proprietorship, nonprofit or government agency whose communications or 22 |
|---|
| 104 | 104 | | transactions with the controller occur solely within the context of that individual's role with the 23 |
|---|
| 105 | 105 | | company, partnership, sole proprietorship, nonprofit or government agency. 24 |
|---|
| 106 | 106 | | (11) “Dark pattern" means a user interface designed or manipulated with the substantial 25 |
|---|
| 107 | 107 | | effect of subverting or impairing user autonomy, decision-making or choice, and includes, but is 26 |
|---|
| 108 | 108 | | not limited to, any practice the Federal Trade Commission refers to as a "dark pattern". 27 |
|---|
| 109 | 109 | | (12) "Decisions that produce legal or similarly significant effects concerning the customer" 28 |
|---|
| 110 | 110 | | means decisions made by the controller that result in the provision or denial by the controller of 29 |
|---|
| 111 | 111 | | financial or lending services, housing, insurance, education enrollment or opportunity, criminal 30 |
|---|
| 112 | 112 | | justice, employment opportunities, health care services or access to essential goods or services. 31 |
|---|
| 113 | 113 | | (13) "De-identified data" means data that cannot reasonably be used to infer information 32 |
|---|
| 114 | 114 | | about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such 33 |
|---|
| 115 | 115 | | individual, if the controller that possesses such data takes reasonable measures to ensure that such 34 |
|---|
| 116 | 116 | | |
|---|
| 117 | 117 | | |
|---|
| 118 | 118 | | LC002702 - Page 4 of 18 |
|---|
| 119 | 119 | | data cannot be associated with an individual, publicly commits to process such data only in a de-1 |
|---|
| 120 | 120 | | identified fashion and not attempt to re-identify such data, and contractually obligates any 2 |
|---|
| 121 | 121 | | recipients of such data. 3 |
|---|
| 122 | 122 | | (14) "Disclose" means to sell, release, transfer, share, disseminate, make available, or 4 |
|---|
| 123 | 123 | | otherwise communicate orally, in writing, or by electronic means or any other means to any 5 |
|---|
| 124 | 124 | | individual or third party in exchange for anything of value. "Disclose" does not include the 6 |
|---|
| 125 | 125 | | following: 7 |
|---|
| 126 | 126 | | (i) Disclosure to an affiliate; provided that, the affiliate does not disclose the personally 8 |
|---|
| 127 | 127 | | identifiable information to any third party; 9 |
|---|
| 128 | 128 | | (ii) Disclosure of personally identifiable information by any entity to a third party under a 10 |
|---|
| 129 | 129 | | written contract authorizing the third party to utilize the personally identifiable information to 11 |
|---|
| 130 | 130 | | perform services on behalf of such entity, including maintaining or servicing accounts, providing 12 |
|---|
| 131 | 131 | | customer service, processing or fulfilling orders and transactions, verifying customer information, 13 |
|---|
| 132 | 132 | | processing payments, providing financing, or similar services, but only if: 14 |
|---|
| 133 | 133 | | (A) The contract prohibits the third party from using the personally identifiable information 15 |
|---|
| 134 | 134 | | for any reason other than performing the specified service or services on behalf of such entity and 16 |
|---|
| 135 | 135 | | from disclosing any such personally identifiable information to additional third parties; and 17 |
|---|
| 136 | 136 | | (B) The entity effectively enforces these prohibitions; 18 |
|---|
| 137 | 137 | | (iii) Disclosure of personally identifiable information by a business to a third party based 19 |
|---|
| 138 | 138 | | on a good-faith belief that disclosure is required to comply with applicable law, regulation, legal 20 |
|---|
| 139 | 139 | | process, or court order; or 21 |
|---|
| 140 | 140 | | (iv) Disclosure of personally identifiable information by any entity to a third party that is 22 |
|---|
| 141 | 141 | | reasonably necessary to address fraud, security, or technical issues; to protect the disclosing entity's 23 |
|---|
| 142 | 142 | | rights or property; or to protect customers or the public from illegal activities as required or 24 |
|---|
| 143 | 143 | | permitted by law. 25 |
|---|
| 144 | 144 | | (15) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 26 |
|---|
| 145 | 145 | | USC 1320d et seq., as amended from time to time. 27 |
|---|
| 146 | 146 | | (16) "Identified or identifiable individual" means an individual who can be readily 28 |
|---|
| 147 | 147 | | identified, directly or indirectly. 29 |
|---|
| 148 | 148 | | (17) "Institution of higher education" means any individual who, or school, board, 30 |
|---|
| 149 | 149 | | association, limited liability company or corporation that, is licensed or accredited to offer one or 31 |
|---|
| 150 | 150 | | more programs of higher learning leading to one or more degrees. 32 |
|---|
| 151 | 151 | | (18) "Nonprofit organization" means any organization that is exempt from taxation under 33 |
|---|
| 152 | 152 | | Section 501(c)(3), 501(c)(4), 501(c)(6) or 501(c)(12) of the Internal Revenue Code of 1986, or any 34 |
|---|
| 153 | 153 | | |
|---|
| 154 | 154 | | |
|---|
| 155 | 155 | | LC002702 - Page 5 of 18 |
|---|
| 156 | 156 | | subsequent corresponding internal revenue code of the United States, as amended from time to 1 |
|---|
| 157 | 157 | | time. 2 |
|---|
| 158 | 158 | | (19) "Operator" means any person or entity that owns a website located on the Internet or 3 |
|---|
| 159 | 159 | | an online service that collects and maintains personally identifiable information from a customer 4 |
|---|
| 160 | 160 | | residing in this state who uses or visits the website or online service, if the website or online service 5 |
|---|
| 161 | 161 | | is operated for commercial purposes. It does not include any third party that operates, hosts, or 6 |
|---|
| 162 | 162 | | manages, but does not own, a website or online service on the owner's behalf or by processing 7 |
|---|
| 163 | 163 | | information on behalf of the owner. "Operator" does not include businesses having ten (10) or fewer 8 |
|---|
| 164 | 164 | | employees, or any third party that operates, hosts, or manages, but does not own, a website or online 9 |
|---|
| 165 | 165 | | service on the owner’s behalf or by processing information on behalf of the owner. 10 |
|---|
| 166 | 166 | | (20) "Personally identifiable information" or "personal information" means any 11 |
|---|
| 167 | 167 | | information that is linked or reasonably linkable to an identified or identifiable individual. 12 |
|---|
| 168 | 168 | | "Personal data" does not include de-identified data or publicly available information, means an 13 |
|---|
| 169 | 169 | | individual's first name or first initial and last name in combination with any one or more of the 14 |
|---|
| 170 | 170 | | following data elements, when the name and the data elements are not either encrypted or utilizing 15 |
|---|
| 171 | 171 | | a protocol that provides a higher degree of security or are in hard copy, paper format: 16 |
|---|
| 172 | 172 | | (i) Social security number; 17 |
|---|
| 173 | 173 | | (ii) Driver's license number, passport number, Rhode Island identification card number, or 18 |
|---|
| 174 | 174 | | tribal identification number; 19 |
|---|
| 175 | 175 | | (iii) Account number, credit or debit card number, in combination with any required 20 |
|---|
| 176 | 176 | | security code, access code, password, or personal identification number, that would permit access 21 |
|---|
| 177 | 177 | | to an individual's financial account; 22 |
|---|
| 178 | 178 | | (iv) Medical or health insurance information; 23 |
|---|
| 179 | 179 | | (v) Email address with any required security code, access code, or password that would 24 |
|---|
| 180 | 180 | | permit access to an individual's personal, medical, insurance, or financial account; or 25 |
|---|
| 181 | 181 | | (vi) Biometric data. 26 |
|---|
| 182 | 182 | | (21) "Precise geolocation data" means information derived from technology, including, but 27 |
|---|
| 183 | 183 | | not limited to, global positioning system level latitude and longitude coordinates or other 28 |
|---|
| 184 | 184 | | mechanisms, that directly identifies the specific location of an individual with precision and 29 |
|---|
| 185 | 185 | | accuracy within a radius of one thousand seven hundred fifty feet (1,750'). "Precise geolocation 30 |
|---|
| 186 | 186 | | data" does not include the content of communications or any data generated by or connected to 31 |
|---|
| 187 | 187 | | advanced utility metering infrastructure systems or equipment for use by a utility. 32 |
|---|
| 188 | 188 | | (22) "Process" or "processing" means any operation or set of operations performed, 33 |
|---|
| 189 | 189 | | whether by manual or automated means, on personal data or on sets of personal data, such as the 34 |
|---|
| 190 | 190 | | |
|---|
| 191 | 191 | | |
|---|
| 192 | 192 | | LC002702 - Page 6 of 18 |
|---|
| 193 | 193 | | collection, use, storage, disclosure, analysis, deletion or modification of personal data. "Processor" 1 |
|---|
| 194 | 194 | | means an individual who, or legal entity that, processes personal data on behalf of a controller. 2 |
|---|
| 195 | 195 | | (23) "Profiling" means any form of automated processing performed on personal data to 3 |
|---|
| 196 | 196 | | evaluate, analyze or predict personal aspects related to an identified or identifiable individual's 4 |
|---|
| 197 | 197 | | economic situation, health, personal preferences, interests, reliability, behavior, location or 5 |
|---|
| 198 | 198 | | movements. 6 |
|---|
| 199 | 199 | | (24) "Protected health information" has the same meaning as provided in HIPAA. 7 |
|---|
| 200 | 200 | | (25) "Pseudonymous data" means personal data that cannot be attributed to a specific 8 |
|---|
| 201 | 201 | | individual without the use of additional information; provided such additional information is kept 9 |
|---|
| 202 | 202 | | separately and is subject to appropriate technical and organizational measures to ensure that the 10 |
|---|
| 203 | 203 | | personal data is not attributed to an identified or identifiable individual. 11 |
|---|
| 204 | 204 | | (26) "Publicly available information" means information that is lawfully made available 12 |
|---|
| 205 | 205 | | through federal, state or municipal government records or widely distributed media, and a controller 13 |
|---|
| 206 | 206 | | has a reasonable basis to believe a customer has lawfully made available to the general public. 14 |
|---|
| 207 | 207 | | (27) "Sale of personal data" means the exchange of personal data for monetary or other 15 |
|---|
| 208 | 208 | | valuable consideration by the controller to a third party. "Sale of personal data" does not include 16 |
|---|
| 209 | 209 | | the disclosure of personal data to a processor that processes the personal data on behalf of the 17 |
|---|
| 210 | 210 | | controller, the disclosure of personal data to a third party for purposes of providing a product or 18 |
|---|
| 211 | 211 | | service requested by the customer, the disclosure or transfer of personal data to an affiliate of the 19 |
|---|
| 212 | 212 | | controller, the disclosure of personal data where the customer directs the controller to disclose the 20 |
|---|
| 213 | 213 | | personal data or intentionally us the controller to interact with a third party, the disclosure of 21 |
|---|
| 214 | 214 | | personal data that the customer: 22 |
|---|
| 215 | 215 | | (i) Intentionally made available to the general public via a channel of mass media; and 23 |
|---|
| 216 | 216 | | (ii) Did not restrict to a specific audience, or the disclosure or transfer of personal data to 24 |
|---|
| 217 | 217 | | a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction, or a 25 |
|---|
| 218 | 218 | | proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes 26 |
|---|
| 219 | 219 | | control of all or part of the controller's assets. 27 |
|---|
| 220 | 220 | | (28) "Sensitive data" means personal data that includes data revealing racial or ethnic 28 |
|---|
| 221 | 221 | | origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation 29 |
|---|
| 222 | 222 | | or citizenship or immigration status, the processing of genetic or biometric data for the purpose of 30 |
|---|
| 223 | 223 | | uniquely identifying an individual, personal data collected from a known child, or precise 31 |
|---|
| 224 | 224 | | geolocation data. 32 |
|---|
| 225 | 225 | | (29) "Targeted advertising" means displaying advertisements to a customer where the 33 |
|---|
| 226 | 226 | | advertisement is selected based on personal data obtained or inferred from that customer's activities 34 |
|---|
| 227 | 227 | | |
|---|
| 228 | 228 | | |
|---|
| 229 | 229 | | LC002702 - Page 7 of 18 |
|---|
| 230 | 230 | | over time and across nonaffiliated Internet websites or online applications to predict such 1 |
|---|
| 231 | 231 | | customer's preferences or interests. "Targeted advertising" does not include advertisements based 2 |
|---|
| 232 | 232 | | on activities within a controller's own Internet websites or online applications, advertisements 3 |
|---|
| 233 | 233 | | based on the context of a customer's current search query, visit to an Internet website or online 4 |
|---|
| 234 | 234 | | application, advertisements directed to a customer in response to the customer's request for 5 |
|---|
| 235 | 235 | | information or feedback, or processing personal data solely to measure or report advertising 6 |
|---|
| 236 | 236 | | frequency, performance or reach. 7 |
|---|
| 237 | 237 | | (30) "Third party" means an individual or legal entity, such as a public authority, agency 8 |
|---|
| 238 | 238 | | or body, other than the customer, controller or processor or an affiliate of the processor or the 9 |
|---|
| 239 | 239 | | controller. "Third party" also means any entity that is a separate legal entity from the entity that has 10 |
|---|
| 240 | 240 | | disclosed the personally identifiable information; provided, however, that an affiliate of the entity 11 |
|---|
| 241 | 241 | | that has disclosed the personally identifiable information shall not be considered a third party. 12 |
|---|
| 242 | 242 | | (31) "Trade secret" mean information that has either actual or potential independent 13 |
|---|
| 243 | 243 | | economic value by virtue of not being generally known, has value to others who cannot legitimately 14 |
|---|
| 244 | 244 | | obtain the information, and subject to reasonable efforts to maintain its secrecy. 15 |
|---|
| 245 | 245 | | 6-48.1-4. Information sharing practices. 16 |
|---|
| 246 | 246 | | (a) An operator of a commercial website or online service that collects, stores and sells 17 |
|---|
| 247 | 247 | | categories of personally identifiable information through the Internet about individual customers 18 |
|---|
| 248 | 248 | | residing in this state who use or visit its commercial website or online service shall, in its customer 19 |
|---|
| 249 | 249 | | agreement or incorporated addendum or in another conspicuous location on its website or online 20 |
|---|
| 250 | 250 | | service platform where similar notices are customarily posted: 21 |
|---|
| 251 | 251 | | (1) Identify all categories of personally identifiable information that the operator collects 22 |
|---|
| 252 | 252 | | through the website or online service about individual customers who use or visit its commercial 23 |
|---|
| 253 | 253 | | website or online service; and 24 |
|---|
| 254 | 254 | | (2) Identify all third-party persons or entities with whom the operator may disclose that 25 |
|---|
| 255 | 255 | | personally identifiable information. 26 |
|---|
| 256 | 256 | | (b) Nothing in this chapter shall be construed to authorize the collection, storage or 27 |
|---|
| 257 | 257 | | disclosure of information or data that is otherwise prohibited, restricted or regulated by state or 28 |
|---|
| 258 | 258 | | federal law. 29 |
|---|
| 259 | 259 | | (c) An operator shall limit the collection of personal data to what is adequate, relevant and 30 |
|---|
| 260 | 260 | | reasonably necessary in relation to the purposes for which data is processed, as disclosed to the 31 |
|---|
| 261 | 261 | | customer. The operator shall not process personal data for purposes that are not reasonably 32 |
|---|
| 262 | 262 | | necessary to, nor compatible with, the disclosed purposes for which such personal data is processed, 33 |
|---|
| 263 | 263 | | as disclosed to the customer, unless the controller obtains the customer’s consent. 34 |
|---|
| 264 | 264 | | |
|---|
| 265 | 265 | | |
|---|
| 266 | 266 | | LC002702 - Page 8 of 18 |
|---|
| 267 | 267 | | (d) Collection of data for bona fide loyalty, rewards, premium features, discount or club 1 |
|---|
| 268 | 268 | | card programs that customers voluntarily participate and consent to using identifiable information 2 |
|---|
| 269 | 269 | | shall be exempt. 3 |
|---|
| 270 | 270 | | (e) This chapter does not apply to any body, authority, board, bureau, commission, district 4 |
|---|
| 271 | 271 | | or agency of this state or any political subdivision of this state; nonprofit organization; institution 5 |
|---|
| 272 | 272 | | of higher education; national securities association that is registered under 15 USC 78o-3 of the 6 |
|---|
| 273 | 273 | | Securities Exchange Act of 1934, as amended from time to time; financial institution or data subject 7 |
|---|
| 274 | 274 | | to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq.; or covered entity or business 8 |
|---|
| 275 | 275 | | associate, as defined in 45 CFR 160.103. 9 |
|---|
| 276 | 276 | | (f) The following information and data are exempt from the provisions of this chapter: 10 |
|---|
| 277 | 277 | | (1) Protected health information under HIPAA; 11 |
|---|
| 278 | 278 | | (2) Patient-identifying information for purposes of 42 USC 290dd-2; 12 |
|---|
| 279 | 279 | | (3) Identifiable private information for purposes of the federal policy for the protection of 13 |
|---|
| 280 | 280 | | human subjects under 45 CFR 46; 14 |
|---|
| 281 | 281 | | (4) Identifiable private information that is otherwise information collected as part of human 15 |
|---|
| 282 | 282 | | subjects research pursuant to the good clinical practice guidelines issued by the International 16 |
|---|
| 283 | 283 | | Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use; 17 |
|---|
| 284 | 284 | | (5) The protection of human subjects under 21 CFR Parts 6, 50 and 56, or personal data 18 |
|---|
| 285 | 285 | | used or shared in research, as defined in 45 CFR 164.501 or other research conducted in accordance 19 |
|---|
| 286 | 286 | | with applicable law; 20 |
|---|
| 287 | 287 | | (6) Information and documents created for purposes of the Health Care Quality 21 |
|---|
| 288 | 288 | | Improvement Act of 1986, 42 USC 11101 et seq.; 22 |
|---|
| 289 | 289 | | (7) Patient safety work product for purposes of section 19a-127o of the general statutes and 23 |
|---|
| 290 | 290 | | the Patient Safety and Quality Improvement Act, 42 USC 299b-21 et seq., as amended from time 24 |
|---|
| 291 | 291 | | to time; 25 |
|---|
| 292 | 292 | | (8) Information derived from any of the health care related information listed in this 26 |
|---|
| 293 | 293 | | subsection that is de-identified in accordance with the requirements for de-identification pursuant 27 |
|---|
| 294 | 294 | | to HIPAA; 28 |
|---|
| 295 | 295 | | (9) Information originating from and intermingled to be indistinguishable with, or 29 |
|---|
| 296 | 296 | | information treated in the same manner as, information exempt under this subsection that is 30 |
|---|
| 297 | 297 | | maintained by a covered entity or business associate, program or qualified service organization, as 31 |
|---|
| 298 | 298 | | specified in 42 USC 290dd-2, as amended from time to time; 32 |
|---|
| 299 | 299 | | (10) Information used for public health activities and purposes as authorized by HIPAA, 33 |
|---|
| 300 | 300 | | community health activities and population health activities; 34 |
|---|
| 301 | 301 | | |
|---|
| 302 | 302 | | |
|---|
| 303 | 303 | | LC002702 - Page 9 of 18 |
|---|
| 304 | 304 | | (11) The collection, maintenance, disclosure, sale, communication or use of any personal 1 |
|---|
| 305 | 305 | | information bearing on a customer's credit worthiness, credit standing, credit capacity, character, 2 |
|---|
| 306 | 306 | | general reputation, personal characteristics or mode of living by a customer reporting agency, 3 |
|---|
| 307 | 307 | | furnisher or user that provides information for use in a customer report, and by a user of a customer 4 |
|---|
| 308 | 308 | | report, but only to the extent that such activity is regulated by and authorized under the Fair Credit 5 |
|---|
| 309 | 309 | | Reporting Act, 15 USC 1681 et seq., as amended from time to time; 6 |
|---|
| 310 | 310 | | (12) Personal data collected, processed, sold or disclosed in compliance with the Driver's 7 |
|---|
| 311 | 311 | | Privacy Protection Act of 1994, 18 USC 2721 et seq., as amended from time to time; 8 |
|---|
| 312 | 312 | | (13) Personal data regulated by the Family Educational Rights and Privacy Act, 20 USC 9 |
|---|
| 313 | 313 | | 1232g et seq., as amended from time to time; 10 |
|---|
| 314 | 314 | | (14) Personal data collected, processed, sold or disclosed in compliance with the Farm 11 |
|---|
| 315 | 315 | | Credit Act, 12 USC 2001 et seq., as amended from time to time; 12 |
|---|
| 316 | 316 | | (15) Data processed or maintained in the course of an individual applying to, employed by 13 |
|---|
| 317 | 317 | | or acting as an agent or independent contractor of a controller, processor or third party, to the extent 14 |
|---|
| 318 | 318 | | that the data is collected and used within the context of that role, as the emergency contact 15 |
|---|
| 319 | 319 | | information of an individual or that is necessary to retain to administer benefits for another 16 |
|---|
| 320 | 320 | | individual relating to the individual who is the subject of the information under this subsection and 17 |
|---|
| 321 | 321 | | used for the purposes of administering such benefits; and 18 |
|---|
| 322 | 322 | | (16) Personal data collected, processed, sold or disclosed in relation to price, route or 19 |
|---|
| 323 | 323 | | service, as such terms are used in the Airline Deregulation Act, 49 USC 40101 et seq., as amended 20 |
|---|
| 324 | 324 | | from time to time, by an air carrier subject to said act, to the extent sections 1 to 11, inclusive, of 21 |
|---|
| 325 | 325 | | this chapter are preempted by the Airline Deregulation Act, 49 USC 41713, as amended from time 22 |
|---|
| 326 | 326 | | to time. 23 |
|---|
| 327 | 327 | | 6-48.1-5. Processing of information. 24 |
|---|
| 328 | 328 | | (a) The operator shall establish, implement, and maintain reasonable administrative, 25 |
|---|
| 329 | 329 | | technical and physical data security practices to protect the confidentiality, integrity and 26 |
|---|
| 330 | 330 | | accessibility of personal data. 27 |
|---|
| 331 | 331 | | (b) The operator shall not process sensitive data concerning a customer without obtaining 28 |
|---|
| 332 | 332 | | customer consent and shall not process sensitive data of a child unless consent is obtained and the 29 |
|---|
| 333 | 333 | | information is processed in accordance with COPPA. 30 |
|---|
| 334 | 334 | | (c) The operator shall not process personal data in violation of the laws of this state and 31 |
|---|
| 335 | 335 | | federal laws that prohibit unlawful discrimination against customers. 32 |
|---|
| 336 | 336 | | (d) The operator shall provide the customer with a mechanism to grant and revoke consent. 33 |
|---|
| 337 | 337 | | Upon revocation of the consent the operator shall not process the data as soon as practicable, but 34 |
|---|
| 338 | 338 | | |
|---|
| 339 | 339 | | |
|---|
| 340 | 340 | | LC002702 - Page 10 of 18 |
|---|
| 341 | 341 | | no later than ten (10) days after the receipt of the request. 1 |
|---|
| 342 | 342 | | (e) The operator shall not process the personal data of a customer for targeted advertising, 2 |
|---|
| 343 | 343 | | or sell the customer’s personal data without the customer’s consent. No operator shall process or 3 |
|---|
| 344 | 344 | | sell the personal data of a customer that is a minor. 4 |
|---|
| 345 | 345 | | 6-48.1-6. Customer rights. 5 |
|---|
| 346 | 346 | | (a) No operator shall discriminate against a customer for exercising their customer rights. 6 |
|---|
| 347 | 347 | | (b) No operator shall deny goods or services, charge different prices or rates for goods or 7 |
|---|
| 348 | 348 | | services or provide a different level of quality of goods or services to the customer if the customer 8 |
|---|
| 349 | 349 | | does not consent to use of their data. 9 |
|---|
| 350 | 350 | | (c) Operators may provide different prices and levels for goods and services if it is for a 10 |
|---|
| 351 | 351 | | bona fide loyalty, rewards, premium features, discount or club card programs that customers 11 |
|---|
| 352 | 352 | | voluntarily participate. 12 |
|---|
| 353 | 353 | | (d) Customers exercising their customers rights under this section shall not be denied goods 13 |
|---|
| 354 | 354 | | or services or provided a different level of quality of goods or services. 14 |
|---|
| 355 | 355 | | (e) A customer shall have the right to: 15 |
|---|
| 356 | 356 | | (1) Confirm whether or not a controller is processing the customer's personal data and 16 |
|---|
| 357 | 357 | | access such personal data, unless such confirmation or access would require the controller to reveal 17 |
|---|
| 358 | 358 | | a trade secret; 18 |
|---|
| 359 | 359 | | (2) Correct inaccuracies in the customer's personal data and delete personal data provided 19 |
|---|
| 360 | 360 | | by, or obtained about, the customer; 20 |
|---|
| 361 | 361 | | (3) Obtain a copy of the customer's personal data processed by the controller, in a portable 21 |
|---|
| 362 | 362 | | and, to the extent technically feasible, readily usable format that allows the customer to transmit 22 |
|---|
| 363 | 363 | | the data to another controller; and 23 |
|---|
| 364 | 364 | | (4) Opt out of the processing of the personal data for purposes of targeted advertising, the 24 |
|---|
| 365 | 365 | | sale of personal data, or profiling in furtherance of solely automated decisions that produce legal 25 |
|---|
| 366 | 366 | | or similarly significant effects concerning the customer. 26 |
|---|
| 367 | 367 | | (f) A customer may exercise rights under this section by a secure and reliable means 27 |
|---|
| 368 | 368 | | established by the controller and described to the customer in the controller's privacy notice. A 28 |
|---|
| 369 | 369 | | customer may designate an authorized agent to exercise the rights of such customer to opt out of 29 |
|---|
| 370 | 370 | | the processing of such customer's personal data. In the case of processing personal data of a known 30 |
|---|
| 371 | 371 | | child, the parent or legal guardian may exercise such customer rights on the child's behalf. In the 31 |
|---|
| 372 | 372 | | case of processing personal data concerning a customer subject to a guardianship, conservatorship 32 |
|---|
| 373 | 373 | | or other protective arrangement, the guardian or the conservator of the customer may exercise such 33 |
|---|
| 374 | 374 | | rights on the customer's behalf. 34 |
|---|
| 375 | 375 | | |
|---|
| 376 | 376 | | |
|---|
| 377 | 377 | | LC002702 - Page 11 of 18 |
|---|
| 378 | 378 | | 6-48.1-7. Exercising customer rights. 1 |
|---|
| 379 | 379 | | A controller shall comply with a request by a customer to exercise the customer rights 2 |
|---|
| 380 | 380 | | authorized as follows: 3 |
|---|
| 381 | 381 | | (1) A controller shall respond to the customer without undue delay, but not later than forty-4 |
|---|
| 382 | 382 | | five (45) days after receipt of the request. The controller may extend the response period by forty-5 |
|---|
| 383 | 383 | | five (45) additional days when reasonably necessary, considering the complexity and number of 6 |
|---|
| 384 | 384 | | the customer's requests; provided the controller informs the customer of any such extension within 7 |
|---|
| 385 | 385 | | the initial forty-five (45)-day response period and of the reason for the extension. 8 |
|---|
| 386 | 386 | | (2) If a controller declines to act regarding the customer's request, the controller shall 9 |
|---|
| 387 | 387 | | inform the customer without undue delay, but not later than forty-five (45) days after receipt of the 10 |
|---|
| 388 | 388 | | request, of the justification for declining to act and instructions for how to appeal the decision. 11 |
|---|
| 389 | 389 | | (3) Information provided in response to a customer request shall be provided by a 12 |
|---|
| 390 | 390 | | controller, free of charge, once per customer during any twelve (12) month period. If requests from 13 |
|---|
| 391 | 391 | | a customer are manifestly unfounded, excessive or repetitive, the controller may charge the 14 |
|---|
| 392 | 392 | | customer a reasonable fee to cover the administrative costs of complying with the request or decline 15 |
|---|
| 393 | 393 | | to act on the request. The controller bears the burden of demonstrating the manifestly unfounded, 16 |
|---|
| 394 | 394 | | excessive or repetitive nature of the request. 17 |
|---|
| 395 | 395 | | (4) If a controller is unable to authenticate a request to exercise any of the rights afforded, 18 |
|---|
| 396 | 396 | | the controller shall not be required to comply with a request to initiate an action pursuant to this 19 |
|---|
| 397 | 397 | | section and shall provide notice to the customer that the controller is unable to authenticate the 20 |
|---|
| 398 | 398 | | request to exercise such right or rights until such customer provides additional information 21 |
|---|
| 399 | 399 | | reasonably necessary to authenticate such customer and such customer's request to exercise such 22 |
|---|
| 400 | 400 | | right or rights. A controller shall not be required to authenticate an opt-out request, but may deny 23 |
|---|
| 401 | 401 | | an opt-out request if the controller has, reasonable and documented belief that such request is 24 |
|---|
| 402 | 402 | | fraudulent. If a controller denies an opt-out request because the controller believes such request is 25 |
|---|
| 403 | 403 | | fraudulent, the controller shall send a notice to the person who made such request disclosing that 26 |
|---|
| 404 | 404 | | such controller believes such request is fraudulent, why such controller believes such request is 27 |
|---|
| 405 | 405 | | fraudulent and that such controller shall not comply with such request. 28 |
|---|
| 406 | 406 | | (5) A controller that has obtained personal data about a customer from a source other than 29 |
|---|
| 407 | 407 | | the customer shall be deemed in compliance with a customer's request to delete such data. 30 |
|---|
| 408 | 408 | | (6) A controller shall establish a process for a customer to appeal the controller's refusal to 31 |
|---|
| 409 | 409 | | take action on a request within a reasonable period of time after the customer's receipt of the 32 |
|---|
| 410 | 410 | | decision. The appeal process shall be conspicuously available. Not later than sixty (60) days after 33 |
|---|
| 411 | 411 | | receipt of an appeal, a controller shall inform the customer in writing of any action taken or not 34 |
|---|
| 412 | 412 | | |
|---|
| 413 | 413 | | |
|---|
| 414 | 414 | | LC002702 - Page 12 of 18 |
|---|
| 415 | 415 | | taken in response to the appeal, including a written explanation of the reasons for the decisions. If 1 |
|---|
| 416 | 416 | | the appeal is denied, the controller shall also provide the customer with a method to submit a 2 |
|---|
| 417 | 417 | | complaint to the attorney general. 3 |
|---|
| 418 | 418 | | (7) A customer may designate another person to serve as the customer's authorized agent, 4 |
|---|
| 419 | 419 | | and act on such customer's behalf, to opt out of the processing of such customer's personal data. A 5 |
|---|
| 420 | 420 | | controller shall comply with an opt-out request received from an authorized agent if the controller 6 |
|---|
| 421 | 421 | | is able to verify the identity of the customer and the authorized agent's authority to act on the 7 |
|---|
| 422 | 422 | | customer’s behalf. 8 |
|---|
| 423 | 423 | | 6-48.1-8. Controller and processor responsibilities. 9 |
|---|
| 424 | 424 | | (a) A controller shall establish, and shall describe in a privacy notice, one or more secure 10 |
|---|
| 425 | 425 | | and reliable means for customers to submit a request to exercise their customer rights and shall 11 |
|---|
| 426 | 426 | | provide customers with a reasonably accessible, clear and meaningful privacy notice that includes: 12 |
|---|
| 427 | 427 | | (1) The categories of personal data processed by the controller; 13 |
|---|
| 428 | 428 | | (2) The purpose for processing personal data; 14 |
|---|
| 429 | 429 | | (3) How customers may exercise their customer rights, including how a customer may 15 |
|---|
| 430 | 430 | | appeal a controller's decision with regard to the customer's request; 16 |
|---|
| 431 | 431 | | (4) The categories of personal data that the controller shares with third parties, if any; 17 |
|---|
| 432 | 432 | | (5) The categories of third parties, if any, with which the controller shares personal data; 18 |
|---|
| 433 | 433 | | and 19 |
|---|
| 434 | 434 | | (6) An active electronic mail address or other online mechanism that the customer may use 20 |
|---|
| 435 | 435 | | to contact the controller. 21 |
|---|
| 436 | 436 | | (b) If a controller sells personal data to third parties or processes personal data for targeted 22 |
|---|
| 437 | 437 | | advertising, the controller shall clearly and conspicuously disclose such processing, as well as the 23 |
|---|
| 438 | 438 | | manner in which a customer may exercise the right to opt out of such processing. 24 |
|---|
| 439 | 439 | | (c) A processor shall adhere to the instructions of a controller and shall assist the controller 25 |
|---|
| 440 | 440 | | in meeting the controller's obligations of this chapter. 26 |
|---|
| 441 | 441 | | (d) A contract between a controller and a processor shall govern the processor's data 27 |
|---|
| 442 | 442 | | processing procedures with respect to processing performed on behalf of the controller. The 28 |
|---|
| 443 | 443 | | contract shall be binding and clearly set forth instructions for processing data, the nature and 29 |
|---|
| 444 | 444 | | purpose of processing, the type of data subject to processing, the duration of processing and the 30 |
|---|
| 445 | 445 | | rights and obligations of both parties. The contract shall also require that the processor: 31 |
|---|
| 446 | 446 | | (1) Ensure that each person processing personal data is subject to a duty of confidentiality 32 |
|---|
| 447 | 447 | | with respect to the data; 33 |
|---|
| 448 | 448 | | (2) At the controller's direction, delete or return all personal data to the controller as 34 |
|---|
| 449 | 449 | | |
|---|
| 450 | 450 | | |
|---|
| 451 | 451 | | LC002702 - Page 13 of 18 |
|---|
| 452 | 452 | | requested at the end of the provision of services, unless retention of the personal data is required 1 |
|---|
| 453 | 453 | | by law; 2 |
|---|
| 454 | 454 | | (3) Upon the reasonable request of the controller, make available to the controller all 3 |
|---|
| 455 | 455 | | information in its possession necessary to demonstrate the processor's compliance with the 4 |
|---|
| 456 | 456 | | obligations of this chapter; 5 |
|---|
| 457 | 457 | | (4) After providing the controller an opportunity to object, engage any subcontractor 6 |
|---|
| 458 | 458 | | pursuant to a written contract that requires the subcontractor to meet the obligations of the processor 7 |
|---|
| 459 | 459 | | with respect to the personal data; and 8 |
|---|
| 460 | 460 | | (5) Allow, and cooperate with, reasonable assessments by the controller or the controller's 9 |
|---|
| 461 | 461 | | designated assessor, or the processor may arrange for a qualified and independent assessor to assess 10 |
|---|
| 462 | 462 | | the processor's policies and technical and organizational measures in support of the obligations of 11 |
|---|
| 463 | 463 | | this chapter, using an appropriate and accepted control standard of framework and assessment 12 |
|---|
| 464 | 464 | | procedure for such assessments. The processor shall provide a report of such assessment to the 13 |
|---|
| 465 | 465 | | controller upon request. 14 |
|---|
| 466 | 466 | | (e) Nothing in this section shall be construed to relieve a controller or processor from the 15 |
|---|
| 467 | 467 | | liabilities imposed on the controller or processor by virtue of such controller’s or processor’s role 16 |
|---|
| 468 | 468 | | in the processing relationship. If a processor begins, alone or jointly with others, determining the 17 |
|---|
| 469 | 469 | | purposes and means of the processing of personal data, the processor is a controller with respect to 18 |
|---|
| 470 | 470 | | such processing and may be subject to an enforcement action under. 19 |
|---|
| 471 | 471 | | (f) A controller shall conduct and document a data protection assessment for each of the 20 |
|---|
| 472 | 472 | | controller's processing activities that presents a heightened risk of harm to a customer. For the 21 |
|---|
| 473 | 473 | | purposes of this section, processing that presents a heightened risk of harm to a customer includes: 22 |
|---|
| 474 | 474 | | (1) The processing of personal data for the purposes of targeted advertising; 23 |
|---|
| 475 | 475 | | (2) The sale of personal data; 24 |
|---|
| 476 | 476 | | (3) The processing of personal data for the purposes of profiling, where such profiling 25 |
|---|
| 477 | 477 | | presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate 26 |
|---|
| 478 | 478 | | impact on, customers, financial, physical or reputational injury to customers, a physical or other 27 |
|---|
| 479 | 479 | | intrusion upon the solitude or seclusion, or the private affairs or concerns, of customers, where such 28 |
|---|
| 480 | 480 | | intrusion would be offensive to a reasonable person, or other substantial injury to customers; and 29 |
|---|
| 481 | 481 | | (4) The processing of sensitive data. 30 |
|---|
| 482 | 482 | | (g) Any controller in possession of de-identified data shall: 31 |
|---|
| 483 | 483 | | (1) Take reasonable measures to ensure that the data cannot be associated with an 32 |
|---|
| 484 | 484 | | individual; 33 |
|---|
| 485 | 485 | | (2) Publicly commit to maintaining and using de-identified data without attempting to re-34 |
|---|
| 486 | 486 | | |
|---|
| 487 | 487 | | |
|---|
| 488 | 488 | | LC002702 - Page 14 of 18 |
|---|
| 489 | 489 | | identify the data; and 1 |
|---|
| 490 | 490 | | (3) Contractually obligate any recipients of the de-identified data to comply with all 2 |
|---|
| 491 | 491 | | provisions of this chapter. 3 |
|---|
| 492 | 492 | | (h) This chapter shall not be construed to restrict a controller's or processor's ability to: 4 |
|---|
| 493 | 493 | | (1) Comply with federal, state or municipal ordinances or regulations; 5 |
|---|
| 494 | 494 | | (2) Comply with a civil, criminal or regulatory inquiry, investigation, subpoena or 6 |
|---|
| 495 | 495 | | summons by federal, state, municipal or other governmental authorities; 7 |
|---|
| 496 | 496 | | (3) Cooperate with law enforcement agencies concerning conduct or activity that the 8 |
|---|
| 497 | 497 | | controller or processor reasonably and in good faith believes may violate federal, state or municipal 9 |
|---|
| 498 | 498 | | ordinances or regulations; 10 |
|---|
| 499 | 499 | | (4) Investigate, establish, exercise, prepare for or defend legal claims; 11 |
|---|
| 500 | 500 | | (5) Provide a product or service specifically requested by a customer; 12 |
|---|
| 501 | 501 | | (6) Perform under a contract to which a customer is a party, including fulfilling the terms 13 |
|---|
| 502 | 502 | | of a written warranty; 14 |
|---|
| 503 | 503 | | (7) Take steps at the request of a customer prior to entering into a contract; 15 |
|---|
| 504 | 504 | | (8) Take immediate steps to protect an interest that is essential for the life or physical safety 16 |
|---|
| 505 | 505 | | of the customer or another individual, and where the processing cannot be manifestly based on 17 |
|---|
| 506 | 506 | | another legal basis; 18 |
|---|
| 507 | 507 | | (9) Prevent, detect, protect against or respond to security incidents, identity theft, fraud, 19 |
|---|
| 508 | 508 | | harassment, malicious or deceptive activities or any illegal activity, preserve the integrity or 20 |
|---|
| 509 | 509 | | security of systems or investigate, report or prosecute those responsible for any such action; 21 |
|---|
| 510 | 510 | | (10) Engage in public or peer-reviewed scientific or statistical research in the public interest 22 |
|---|
| 511 | 511 | | that adheres to all other applicable ethics and privacy laws and is approved, monitored and governed 23 |
|---|
| 512 | 512 | | by an institutional review board that determines, or similar independent oversight entities that 24 |
|---|
| 513 | 513 | | determine, whether the deletion of the information is likely to provide substantial benefits that do 25 |
|---|
| 514 | 514 | | not exclusively accrue to the controller, the expected benefits of the research outweigh the privacy 26 |
|---|
| 515 | 515 | | risks, and whether the controller has implemented reasonable safeguards to mitigate privacy risks 27 |
|---|
| 516 | 516 | | associated with research, including any risks associated with re-identification; 28 |
|---|
| 517 | 517 | | (11) Assist another controller, processor or third party with any of the obligations of this 29 |
|---|
| 518 | 518 | | chapter; or 30 |
|---|
| 519 | 519 | | (12) Process personal data for reasons of public interest in the area of public health, 31 |
|---|
| 520 | 520 | | community health or population health, but solely to the extent that such processing is: 32 |
|---|
| 521 | 521 | | (i) Subject to suitable and specific measures to safeguard the rights of the customer whose 33 |
|---|
| 522 | 522 | | personal data is being processed, and 34 |
|---|
| 523 | 523 | | |
|---|
| 524 | 524 | | |
|---|
| 525 | 525 | | LC002702 - Page 15 of 18 |
|---|
| 526 | 526 | | (ii) Under the responsibility of a professional subject to confidentiality obligations under 1 |
|---|
| 527 | 527 | | federal, state or local law. 2 |
|---|
| 528 | 528 | | (i) The obligations imposed on controllers or processors shall not restrict a controller's or 3 |
|---|
| 529 | 529 | | processor's ability to collect, use or retain data for internal use to: 4 |
|---|
| 530 | 530 | | (1) Conduct internal research to develop, improve or repair products, services or 5 |
|---|
| 531 | 531 | | technology; 6 |
|---|
| 532 | 532 | | (2) Effectuate a product recall; 7 |
|---|
| 533 | 533 | | (3) Identify and repair technical errors that impair existing or intended functionality; or 8 |
|---|
| 534 | 534 | | (4) Perform internal operations that are reasonably aligned with the expectations of the 9 |
|---|
| 535 | 535 | | customer or reasonably anticipated based on the customer's existing relationship with the controller, 10 |
|---|
| 536 | 536 | | or are otherwise compatible with processing data in furtherance of the provision of a product or 11 |
|---|
| 537 | 537 | | service specifically requested by a customer or the performance of a contract to which the customer 12 |
|---|
| 538 | 538 | | is a party. 13 |
|---|
| 539 | 539 | | (j) A controller or processor that discloses personal data to a processor or third party 14 |
|---|
| 540 | 540 | | controller shall not be deemed to have violated this act if the processor or third-party controller that 15 |
|---|
| 541 | 541 | | receives and processes such personal data violates said sections; provided at the time the disclosing 16 |
|---|
| 542 | 542 | | controller or processor disclosed such personal data, the disclosing controller or processor did not 17 |
|---|
| 543 | 543 | | have actual knowledge that the receiving processor or third-party controller would violate said 18 |
|---|
| 544 | 544 | | sections. A third-party controller or processor receiving personal data from a controller or processor 19 |
|---|
| 545 | 545 | | in compliance with this act is likewise not in violation of said sections for the transgressions of the 20 |
|---|
| 546 | 546 | | controller or processor from which such third-party controller or processor receives such personal 21 |
|---|
| 547 | 547 | | data. 22 |
|---|
| 548 | 548 | | (k) Nothing in this chapter shall be construed to: 23 |
|---|
| 549 | 549 | | (1) Impose any obligation on a controller or processor that adversely affects the rights or 24 |
|---|
| 550 | 550 | | freedoms of any person, including, but not limited to, the rights of any person to freedom of speech 25 |
|---|
| 551 | 551 | | or freedom of the press guaranteed in the First Amendment to the United States Constitution; or 26 |
|---|
| 552 | 552 | | (2) Apply to any person's processing of personal data in the course of such person's purely 27 |
|---|
| 553 | 553 | | personal or household activities. 28 |
|---|
| 554 | 554 | | (l) Personal data processed by a controller pursuant to this section may be processed to the 29 |
|---|
| 555 | 555 | | extent that such processing is reasonably necessary and proportionate to the purposes in this 30 |
|---|
| 556 | 556 | | section; and adequate, relevant and limited to what is necessary in relation to the specific purposes 31 |
|---|
| 557 | 557 | | listed in this section. Personal data collected, used or retained shall, where applicable, consider the 32 |
|---|
| 558 | 558 | | nature and purpose or purposes of such collection, use or retention. Such data shall be subject to 33 |
|---|
| 559 | 559 | | reasonable administrative, technical and physical measures to protect the confidentiality, integrity 34 |
|---|
| 560 | 560 | | |
|---|
| 561 | 561 | | |
|---|
| 562 | 562 | | LC002702 - Page 16 of 18 |
|---|
| 563 | 563 | | and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to 1 |
|---|
| 564 | 564 | | customers relating to such collection, use or retention of personal data. 2 |
|---|
| 565 | 565 | | (m) If a controller processes personal data pursuant to an exemption in this section, the 3 |
|---|
| 566 | 566 | | controller bears the burden of demonstrating that such processing qualifies for the exemption. 4 |
|---|
| 567 | 567 | | (n) Processing personal data for the purposes expressly identified in this section shall not 5 |
|---|
| 568 | 568 | | solely make a legal entity a controller with respect to such processing 6 |
|---|
| 569 | 569 | | 6-48.1-9. Violations. 7 |
|---|
| 570 | 570 | | (a) A violation of this chapter constitutes a violation of the general regulatory provisions 8 |
|---|
| 571 | 571 | | of commercial law in title 6 and shall constitute a deceptive trade practice in violation of chapter 9 |
|---|
| 572 | 572 | | 13.1 of title 6; provided further, that in the event that any individual or entity intentionally discloses 10 |
|---|
| 573 | 573 | | personally identifiable information: 11 |
|---|
| 574 | 574 | | (1) To a shell company or any entity that has been formed or established solely, or in part, 12 |
|---|
| 575 | 575 | | for the purposes of circumventing the intent of this chapter; 13 |
|---|
| 576 | 576 | | (2) To any third party that is not exempt pursuant to § 6-48.1-3; or 14 |
|---|
| 577 | 577 | | (3) In violation of any provision of this chapter, that individual or entity shall pay a fine of 15 |
|---|
| 578 | 578 | | not less than one hundred dollars ($100) and no more than five hundred dollars ($500) for each 16 |
|---|
| 579 | 579 | | such disclosure. 17 |
|---|
| 580 | 580 | | (b) The office of the attorney general shall have sole enforcement authority of the 18 |
|---|
| 581 | 581 | | provisions of this chapter and may enforce a violation of this chapter pursuant to: 19 |
|---|
| 582 | 582 | | (1) The provisions of this section; or 20 |
|---|
| 583 | 583 | | (2) General regulatory provisions of commercial law in title 6, or both. 21 |
|---|
| 584 | 584 | | (c) The attorney general may require a controller to disclose any data protection assessment 22 |
|---|
| 585 | 585 | | that is relevant to an investigation conducted by the attorney general, and the controller shall make 23 |
|---|
| 586 | 586 | | the data protection assessment available. The attorney general may evaluate the data protection 24 |
|---|
| 587 | 587 | | assessment for compliance with the responsibilities of this chapter. 25 |
|---|
| 588 | 588 | | (d) Nothing in this section shall be construed to authorize any private right of action to 26 |
|---|
| 589 | 589 | | enforce any provision of this chapter, any regulation hereunder, or any other provisions of 27 |
|---|
| 590 | 590 | | commercial law in title 6. 28 |
|---|
| 591 | 591 | | 6-48.1-10. Waivers -- Severability. 29 |
|---|
| 592 | 592 | | Any waiver of the provisions of this chapter shall be void and unenforceable. If any 30 |
|---|
| 593 | 593 | | provision of this chapter or its application to any person or circumstance is held invalid by a court 31 |
|---|
| 594 | 594 | | of competent jurisdiction, the invalidity shall not affect other provisions of applications of the 32 |
|---|
| 595 | 595 | | chapter that can be given effect without the invalid provision or application, and to this end the 33 |
|---|
| 596 | 596 | | provisions of the chapter are severable. 34 |
|---|
| 597 | 597 | | |
|---|
| 598 | 598 | | |
|---|
| 599 | 599 | | LC002702 - Page 17 of 18 |
|---|
| 600 | 600 | | 6-48.1-11. Construction. 1 |
|---|
| 601 | 601 | | (a) Nothing in this chapter shall be deemed to apply in any manner to a financial institution 2 |
|---|
| 602 | 602 | | or an affiliate of a financial institution subject to Title V of the Federal Gramm-Leach-Bliley Act 3 |
|---|
| 603 | 603 | | U.S.C. § 6801 et seq. and its implementing regulations, or to information or data subject to the 4 |
|---|
| 604 | 604 | | Health Insurance Portability and Accountability Act of 1996 (HIPAA) Pub. L. 104-191; provided, 5 |
|---|
| 605 | 605 | | however, no entity or individual shall be exempt from the provisions of this chapter. 6 |
|---|
| 606 | 606 | | (b) Nothing in this chapter shall be construed to apply to a contractor, subcontractor, or 7 |
|---|
| 607 | 607 | | agent of a state agency or local unit of government when working for that state agency or local unit 8 |
|---|
| 608 | 608 | | of government. 9 |
|---|
| 609 | 609 | | (c) Nothing in this chapter shall be construed to apply to any entity recognized as a tax 10 |
|---|
| 610 | 610 | | exempt organization under the Internal Revenue Code. 11 |
|---|
| 611 | 611 | | (d) Nothing in this chapter shall be construed to mandate and/or require the retention or 12 |
|---|
| 612 | 612 | | disclosure of any specific individual's personally identifiable information. 13 |
|---|
| 613 | 613 | | (e) Nothing in this chapter shall prohibit or restrict the dissemination or sale of product 14 |
|---|
| 614 | 614 | | sales summaries or statistical information or aggregate customer data which may include 15 |
|---|
| 615 | 615 | | personally, identifiable information. 16 |
|---|
| 616 | 616 | | (f) Nothing in this chapter shall be construed to apply to any personally identifiable 17 |
|---|
| 617 | 617 | | information or any other information collected, used, processed, or disclosed by or for a customer 18 |
|---|
| 618 | 618 | | reporting agency as defined by 15 U.S.C. § 1681a(f). 19 |
|---|
| 619 | 619 | | SECTION 2. This act shall take effect on January 1, 2024. 20 |
|---|
| 620 | 620 | | ======== |
|---|
| 621 | 621 | | LC002702 |
|---|
| 622 | 622 | | ======== |
|---|
| 623 | 623 | | |
|---|
| 624 | 624 | | |
|---|
| 625 | 625 | | LC002702 - Page 18 of 18 |
|---|
| 626 | 626 | | EXPLANATION |
|---|
| 627 | 627 | | BY THE LEGISLATIVE COUNCIL |
|---|
| 628 | 628 | | OF |
|---|
| 629 | 629 | | A N A C T |
|---|
| 630 | 630 | | RELATING TO COMMERCI AL LAW -- GENERAL REGULATORY P ROVISIONS -- |
|---|
| 631 | 631 | | RHODE ISLAND DATA TRANSPARENCY AND PRIVA CY PROTECTION ACT |
|---|
| 632 | 632 | | *** |
|---|
| 633 | 633 | | This act would provide data privacy protections for the personal identifiable information 1 |
|---|
| 634 | 634 | | of Rhode Islanders. 2 |
|---|
| 635 | 635 | | This act would take effect on January 1, 2024. 3 |
|---|
| 636 | 636 | | ======== |
|---|
| 637 | 637 | | LC002702 |
|---|
| 638 | 638 | | ======== |
|---|