SB 642

This bill establishes requirements for controllers and processors of the personal

data of consumers. The bill defines a “controller” as a person that, alone or jointly

with others, determines the purpose and means of processing personal data, and the

bill applies to controllers that control or process the personal data of at least 100,000

consumers or that control or process the personal data of at least 25,000 consumers

and derive over 50 percent of their gross revenue from the sale of personal data.

Under the bill, “personal data” means any information that is linked or reasonably

linkable to an individual except for publicly available information.

The bill provides consumers with the following rights regarding their personal

data: 1) to confirm whether a controller is processing the consumer's personal data

and to access the personal data; 2) to correct inaccuracies in the consumer's personal

data; 3) to require a controller to delete personal data provided by or about the

consumer; 4) to obtain a copy of the personal data that the consumer previously

provided to the controller; and 5) to opt out of the processing of the consumer's

personal data for targeted advertising; the sale of the consumer's personal data; and

certain forms of automated processing of the consumer's personal data. These rights

are subject to certain exceptions specified in the bill. Controllers may not

discriminate against a consumer for exercising rights under the bill, including by

charging different prices for goods or providing a different level of quality of goods

or services.

The bill requires controllers to respond to consumers' requests to invoke rights

under the bill without undue delay. If a controller declines to take action regarding

a consumer's request, the controller must inform the consumer of its justification

without undue delay. The bill also requires that information provided in response

to a consumer's request be provided free of charge once annually per consumer.

Controllers must also establish processes for consumers to appeal a refusal to take

action on a consumer's request. Within 60 days of receiving an appeal, a controller

must inform the consumer in writing of any action taken or not taken in response to

the appeal, including a written explanation of the reasons for its decisions. If the

appeal is denied, the controller must provide the consumer with a method through

which the consumer can contact the attorney general to submit a complaint.

Under the bill, a controller must provide consumers with a privacy notice that

discloses the categories of personal data processed by the controller; the purpose of

processing the personal data; the categories of third parties, if any, with whom the

controller shares personal data; the categories of personal data that the controller

shares with third parties; and information about how consumers may exercise their

rights under the bill. Controllers may not collect or process personal data for

purposes that are not relevant to or reasonably necessary for the purposes disclosed

in the privacy notice. The bill's requirements do not restrict a controller's ability to

collect, use, or retain data for conducting internal research, effectuating a product