SB 361 — Consumer Data Protection Act; protections for children.

or (v) institution of higher education.

S C.

The following information and data is exempt from this chapter:

1.

Protected health information under HIPAA;

E 3.

Patient identifying information for purposes of 42 U.S.C.

§ 290dd-2;

N 4.

Identifiable private information for purposes of the federal policy for the protection of human subjects under 45 C.F.R.

Part 46;

identifiable private information that is otherwise informatioA collected as part of human subjects research pursuant to the good clinical practice guidelines issued by The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for HumanTUse;

research conducted in accordance with the requirements set forth in this chapter, or other researched in conducted in accordance with applicable law;

E 5.

Information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986 (42 U.S.C.

§ 11101 et seq.);

6.

Patient safety work product for purposes of the federal Patient Safety and Quality ImprovSment Act7.

Information derived from any of the health care-related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA;

U 8.

Information originating from, and intermingled to be indistinguishable with, or information treated in the same manner as information exempt under this subsection that is maintained by a covered Sntity or business associate as defined by HIPAA or a program or a qualified service organization as defined by 9.

Information used only for public health activities and purposes as authorized by HIPAA;

T 10.

The collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, generalTreputation, personal characteristics, or mode of living by a consumer reporting agency or furnisher that provides information for use in a consumer report, and by a user of a consumer report, but only to the extent that § 1681 et seq.);

regulated by and authorized under the federal Fair Credit Reporting Act (15 U.T.C.

11.

Personal data collected, processed, sold, or disclosed in compliance with the federal DrEver's Privacy Protection Act of 1994 (18 U.S.C.

§ 2721 et seq.);

12.

Personal data regulated by the federal Family Educational Rights and Privacy Act (20 U.S.C.

§ 1232g et seq.);

Act (12 U.S.C.

§ 2001 et seq.);

andcessed, sold, or disclosed in compliance with the federal Farm Credit 14.

Data processed or maintained (i) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role;

(ii) as the emergency contact iSformation of an individual under this chapter used for emergency contact purposes;

or (iii) that is neces3ary to for the purposes of administering those benefits.ual relating to the individual under clause (i1 and used D.

Controllers and processors that comply with the verifiable parental consent requirements 2f the federal Children's Online Privacy Protection Act (15 U.S.C.

§ 6501 et seq.) shall be deemed compliant with any obligation to obtain parental consent under this chapter if a child is under the age of 13.

For a child 13 years of age or older, controllers and processors shall be deemed compliant with any obligation to obtain parental consent for this chapter if the controller or processor adheres to methods SB361S2 4 of 5 in regulations promulgated by the Federal Trade Commission for compliance with obtaining consent from a child's parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act.

§ 59.1-578.

Data controller responsibilities;

OA. 1.

A controller shall:

1.

Except as otherwise provided in this chapter, not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such persoEalpersonal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent;

discrimination4. against consumers.

Not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers.

However, nothing in this subdivision shall be construed to require a Sontrollercontroller to provide a product or service that requires the personal data of a consumer that the controll3rcontroller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, q1ality,quality, or selection of goods or services to a consumer, including offering goods or services for no fee, Rfif the consumer has exercised his right to opt out pursuant to § 59.1-577 or the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program;

the5. case of the processing of sensitive data concerning a known child, without processing such data inn accordance with the federal Children's Online Privacy Protection Act (15 U.S.C.

Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child under the age of 13, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C.

§ 6501 et seq.);

6.

Not process sensitive data concerning a known child 13 years of age or older, without processing such data pursuant to the applicable provisions for children under the age of 13 in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C.

consumer3. may appeal a controller's decision with regard to the consumer's request;ing how a 4.

How consumers may exercise their consumer rights pursuant § 59.1-577, including how a consumer may appeal a controller's decision with regard to the consumer's request;

4.

Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request.

For any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible witd.with such disclosed purpose;

or d.

Subject to the consent requirement established by subdivision 3, no controller shall collect precise of 45 geolocation data from a known child unless (i) such precise geolocation data is reasonably necessary for the controller to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controller shall only collect such data for the time necessary to provide such online service, product, or feature and (ii) the controller provides to the known child a signal indicating that such controller is collecting such precise geolocation data, which signalsig3. shall be available to such known child for the entire duration of such collection.

3.

§ 6501 et seq.).seq.) if a child is under the age of 13.

For a child 13 years of age or older, controllers and processors shall be deemed compliant with any obligation to promulgated by the Federal Trade Commission for compliance with obtaining consent from a child'sgulations parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act.

1.S 2.

The processing of personal data for purposes of targeted advertising;

2.

3.data for purposes of targeted advertising;

TheE processing3. of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers;

The processing of personal data for purposes of profiling, where such profiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impaNt on, consumers;

(iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusioninArusion wouldwou4. be offensive to a reasonable person;

or (iv) other substantial injury to consumers;

4.

andandor 5.(iv) other substantial injury to consumers;

T 5.

E B.

Each controller that offers any online service, product, or feature directed to consumers whom such controller has actual knowledge are children shall conduct a data protection assessment for such online service, product, or feature that addresses (i) the purpose of such online service, product, or feature;

U C.

Data protection assessments conducted pursuant to subsection A this section shall identifyidentifB and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.

The use of de-identified data and the reasonable expectations of consumers, asTs well as the context of the processing and the relationship between the controller and the consumer whosewhosI personalperC. data will be processed, shall be factored into this assessment by the controller.

C.

The Attorney General may evaluate the data protection assessment for compliance with the T responsibilities set forth in § 59.1-578.

Data protection assessments shall be confidential and exempt fromThe publicdisclosure inspectionof anda copyingdata underprotection assessment pursuant to a request from the VirginiaAttorney FreedomGeneral shall not constitute a waiver of Informationattorney-client Actprivilege (§or 2.2-3700work etproduct seq.).protection with respect to the assessment and any information contained in the assessment.

The disclosure of a data protection assessment pursuant to a request from the Attorney General shall not constitute a waiver of attorney-client privilege or work product protection with respect to the assessment and any information contained in the assessment.

A single data protection assessment may address a comparable set of processing operations that includeincE. similar activities.

E.

S F.

Data protection assessment requirements shall apply to processing activities created oroB generated after January 1, 2023, and are not retroactive.

1 2.