SB 569 — Consumer Privacy Act.

FILED SENATE GENERAL ASSEMBLY OF NORTH CAROLINA AprSESSION 6, 2021 S.B.S 1 SENATE BILL 569 Short Title:

569 SESSION 2021 PRINCIPAL CLERK S D SENATE BILL DRS15222-LR-88A Short Title:

Rules and Operations of the Senate April 7, 2021 A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.

Chapter 75 of the General Statutes is amended bybyadding adding a new Article to read:

Consent may include a written statement, including *DRS15222-LR-88A**S569-v-1* General Assembly Of North Carolina Session 2021 astatementwrittenbyelectronicmeans,oranyotherunambiguousaffirmative action.

"Health record" also includes the substance of any communication made by an individual to a health care entity in confidence during or in connection with the provision of health services or information otherwise acquired by the health care entityentityabout about an individual in confidence and in connection with the provision of health services to the individual.

"Precise geolocation data" does not include the content of communications or anyanydata data generated bybyor or connected to advanced utilityutilitymeteringinfrastructure metering infrastructure systems or equipment for use by a utility.

– Any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of Page 2 DRS15222-LR-88ASenate Bill 569-First Edition General Assembly Of North Carolina Session 2021 personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

The disclosure of information that the consumer (i) intentionallyintentionallymade made available to the general public via a channel of mass media and (ii) did not restrict to a specific audience.

The disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which thethirdpartythethirdpartyassumescontrol assumescontrol ofall or partofthecontroller's assets.

Personal datarevealingracialorethnicdatarevealingracialorethnicorigin, origin, religious beliefs,mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

TheprocessingofgeneticorbiometricdataforthepurposeofuniquelyTheprocessingof geneticorbiometricdataforthepurposeofuniquely identifying a natural person.

DRS15222-LR-88ASenate Bill 569-First Edition Page 3 General Assembly Of North Carolina Session 2021 (30) Targeted advertising.

Parts 6, 50, and 56, or personal data used or shared in research Page 4 DRS15222-LR-88ASenate Bill 569-First Edition General Assembly Of North Carolina Session 2021 conducted in accordance with the requirements set forth in this Article, or other research conducted in accordance with applicable law.

(14) Data processed or maintained (i) in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, orthird party,totheextentparty,totheextentthatthe thatthe data is collected andandusedwithin usedwithin the context of that role, (ii) as the emergency contact information of an individual under this Article used for emergencyemergencycontact contact purposes, or (iii) that is necessary to retain to administer benefits for another individual relating to the individual under clause (iii) and used for the purposes of administering those benefits.

(a) Aconsumermayinvoketheconsumerrights grantedunderthis subsectionsubsectionat at anytime by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke.

(4) To obtain a copycopyof of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, DRS15222-LR-88ASenate Bill 569-First Edition Page 5 General Assembly Of North Carolina Session 2021 readily usable format that allows the consumer to transmit the data to another controllerwithouthindrance,wheretheprocessingiscarriedout byautomated means.

The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of the consumer's requests, so long as the controller informs the consumer of anyanysuch such extension within the initial 45-day45-dayresponse response period, together with the reason for the extension.

(4) If a controller is unable to authenticate the request using commercially reasonableefforts,thecontrollershallnotberequiredtocomplyreasonableefforts,thecontrollershallnotberequiredtocomplywitharequest witharequest to initiate an action under subsection (a) of this section and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request.

Within 60 days of receipt of an appeal, a controller shall inform the consumer in writing of anyanyaction action taken or not taken in response to theappeal, including a written explanation of the reasons for the decisions.

(2) Except as otherwise provided in this Article, not process personal data for purposes that are neither reasonably necessary to nor compatible with the Page 6 DRS15222-LR-88ASenate Bill 569-First Edition General Assembly Of North Carolina Session 2021 disclosed purposes for which such personal data is processed, as disclosed to the consumer, unless the controller obtains the consumer's consent.

(3) Establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibilityaccessibilityof of personal data.

Such data securitysecuritypractices practices shall be appropriate to the volume and nature of the personal data at issue.

(5) Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online PrivacyPrivacyProtection Protection Act, 15 U.S.C.

75-71 shall be deemed contrary to public policypolicyand and shall be void and unenforceable.

Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identityidentityof of the consumer makingmakingthe the request.

DRS15222-LR-88ASenate Bill 569-First Edition Page 7 General Assembly Of North Carolina Session 2021 (a) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting its obligations under this Article.

(1) Taking into account the nature of processing and the information available to the processor, by appropriate technical and organizational measures, insofar as this is reasonablyreasonablypracticable, practicable, to fulfill thecontroller's obligation to respond to consumer rights requests pursuant to G.S.

Page 8 DRS15222-LR-88ASenate Bill 569-First Edition General Assembly Of North Carolina Session 2021 (3) Theprocessingofpersonaldataforpurposesofprofiling,wheresuchprofiling presents a reasonably foreseeable risk of (i) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (ii) financial, physical, or reputational injury to consumers, (iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person, or (iv) other substantial injury to consumers.

(3) The mitigation bysafeguards that will be employed bybythe the controller to reduce any risks to the consumer.

DRS15222-LR-88ASenate Bill 569-First Edition Page 9 General Assembly Of North Carolina Session 2021 (b) Nothing in this Article shall be construed to (i) require a controller or processor to re-identify de-identified data or pseudonymous data or (ii) maintain data in identifiable form, or collect, obtain, retain, or access any data or technology, in order to be capable of associating an authenticated consumer request with personal data.

and (3) The controller does not sell the personal data to any third party or otherwise voluntarilyvoluntarilydisclose disclose the personal data to any third party other than a processor, except as otherwise permitted in this section.

(d) Theconsumer rights containedin subdivisions (a)(1)through(a)(4)ofG.S.(a)(1)through (a)(4) ofG.S.

(a) NothingNothingin in this Article shall be construed to restrict a controller's orprocessor's ability to do any of the following:

(7) Prevent, detect, protect against, or respond to securitysecurityincidents, incidents,identitytheft, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity;

(8) Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, or similar independent oversight entities that determine (i) if the deletion of the information is likely to provide substantial benefits that do not exclusively Page 10 DRS15222-LR-88ASenate Bill 569-First Edition General Assembly Of North Carolina Session 2021 accrue to the controller, (ii) the expected benefits of the research outweigh the privacyprivacyrisks, risks, and(iii)ifthecontrollerhas implementedreasonablesafeguards to mitigate privacy risks associated with research, including any risks associated with reidentification.

(b) The obligations imposed on controllers or processors under this Article shall not restrict a controller's orprocessor's abilityabilityto to collect, use, or retain datato do anyofthe following:

The data shall be subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks DRS15222-LR-88ASenate Bill 569-First Edition Page 11 General Assembly Of North Carolina Session 2021 of harm to consumers relating to such collection, use, or retention of personal data.

(g) If a controller processes personal data pursuant to an exemption in this section, the controller bears the burden of demonstratingdemonstratingthat that such processingprocessingqualifies qualifies for the exemption and complies with the requirements in subsection (f) of this section.

(a) There is herebyherebycreated created the Consumer PrivacyPrivacyFund Fund (Fund).