HB5338: Relating to Safe Harbor for Cybersecurity Programs

Legislative Summary

The purpose of this bill is to all create the Consumer Data Protection Act; establishing a framework for controlling and processing personal data in the state; creating definitions; limiting application to all persons that conduct business in the state and either control or process personal data of at least 100,000 consumers or derive over 50 percent of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers; providing for exemptions; delineating responsibilities and privacy protection standards for data controllers and processors; clarifying standards do not apply to state or local governmental entities; providing exceptions for certain types of data and information governed by federal law; providing that consumers have rights to access, correct, delete, obtain a copy of personal data, and to opt out of the processing of personal data for the purposes of targeted advertising; providing that the Attorney General has exclusive authority to enforce violations of the law; providing for assistance of the Attorney General in obtaining relief; establishing the Consumer Privacy Fund to support this effort; and providing for construction and an effective date.