HB3498: Relating to the Consumer Data Protection Act and establishing a framework for controlling and processing personal data in the State

Legislative Summary

The purpose of this bill is to all create the Consumer Data Protection Act. The bill establishes a framework for controlling and processing personal data in the state. The bill creates definitions. The bill limits application to all persons that conduct business in the state and either control or process personal data of at least 100,000 consumers or derive over 50 percent of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers. The bill provides for exemptions. The bill delineates responsibilities and privacy protection standards for data controllers and processors. The bill clarifies standards do not apply to state or local governmental entities. The bill provides exceptions for certain types of data and information governed by federal law. The bill provides that consumers have rights to access, correct, delete, obtain a copy of personal data, and to opt out of the processing of personal data for the purposes of targeted advertising. The bill provides that the Attorney General has exclusive authority to enforce violations of the law. The bill provides for assistance of the Attorney General in obtaining relief. The bill establishes the Consumer Privacy Fund to support this effort. Finally, the bill provides for construction and an effective date.