SB 525 — Consumer Privacy Act.

FILED SENATE GENERAL ASSEMBLY OF NORTH CAROLINA AprSESSION 3, 2023 S.B.S 1 SENATE BILL 525 Short Title:

525 SESSION 2023 PRINCIPAL CLERK S D SENATE BILL DRS35199-LR-18B Short Title:

Rules and Operations of the Senate April 4, 2023 A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.

75F-4 is made bybythe the consumer who is entitled to exercise those rights.

*DRS35199-LR-18B**S525-v-1* General Assembly Of North Carolina Session 2023 e.

– An affirmative act bybya a consumer that unambiguouslyunambiguouslyindicates indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.

Page 2 DRS35199-LR-18BSenate Bill 525-First Edition General Assembly Of North Carolina Session 2023 c.

– An individual who can be readilyreadilyidentified, identified, directly or indirectly.

(29) Publiclyavailableinformation.–Publiclyavailableinformation. Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonably believes a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.

–Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonablybelieves a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.

– The exchange of personal data for monetarymonetaryconsideration consideration by the controller to a third party.

Considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a DRS35199-LR-18BSenate Bill 525-First Edition Page 3 General Assembly Of North Carolina Session 2023 third party if the purpose is consistent with a consumer's reasonable expectations.

Page 4 DRS35199-LR-18BSenate Bill 525-First Edition General Assembly Of North Carolina Session 2023 (35) Third party.

Information and documents created for purposes of the federal Health CareQualityCareQualityImprovement Improvement Act of1986,42U.S.C.

§11101et§ 11101et seq.,and related regulations.

and DRS35199-LR-18BSenate Bill 525-First Edition Page 5 General Assembly Of North Carolina Session 2023 2.

(8) Information originating from, and intermingled to be indistinguishable with, information under subdivision (7) of this subsection that is maintained bybya a (i) healthcarefacilityorhealthcareprovideror(ii)programoraqualifiedservice organization as defined in 42 C.F.R.

Aconsumer reportingreportingagency,as agency,as definedin 15 U.S.C.

In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third partypartyto to the extent the collection and use of the data are related to the individual's role;

(c) A controller is in compliance with anyanyobligation obligation to obtain parental consent under this Chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C.

Page 6 DRS35199-LR-18BSenate Bill 525-First Edition General Assembly Of North Carolina Session 2023 (d) This Chapter does not require a person to take any action in conflict with the federal Health InsurancePortabilityandAccountabilityActof1996,42U.S.C.

If a controller extends the initial 45-day45-dayperiod, period, before the initial 45-day45-dayperiod period expires, the controller shall (i) inform the consumer of the extension, including the length of the extension, and (ii) provide the reasons the extension is reasonably necessary.

(d) The 45-day period does not applyapplyif if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.

However,acontrollermayHowever,acontrollermaycharge charge areasonablefee to covertheadministrativecosts ofcomplying with a request or refuse to act on a request if:

DRS35199-LR-18BSenate Bill 525-First Edition Page 7 General Assembly Of North Carolina Session 2023 (1) The request is excessive, repetitive, technically infeasible, or manifestly unfounded;

(b) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical datasecuritydatasecuritypractices practices designedto protect theconfidentialitytheconfidentialityandintegrity and integrity of personal data and reduce reasonably foreseeable risks of harm to consumers relating to the Page 8 DRS35199-LR-18BSenate Bill 525-First Edition General Assembly Of North Carolina Session 2023 processing of personal data.

Nothing in this subsection prohibits a controller from offering a different price, rate, level, quality, orselection ofagoodorservicetoofagood aconsumer,includingorserviceto offeringaconsumer,includingofferinga agoodgoodorservice orservice for no fee or at a discount, if the consumer has opted out of targeted advertising or the offer is related to the consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

DRS35199-LR-18BSenate Bill 525-First Edition Page 9 General Assembly Of North Carolina Session 2023 (a) The requirements described in this Chapter do not restrict a controller's or processor's ability to do any of the following:

(8) Detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or anyanyillegal illegal activity orinvestigate,report,orprosecuteapersonresponsibleforanactiondescribed in this subdivision.

(9) Preservetheintegrityorsecurityofsystemsorinvestigate,report,orprosecutePreservetheintegrityorsecurityofsystemsorinvestigate,report,or prosecute a person responsible for harming or threatening the integrity or security of systems.

Page 10 DRS35199-LR-18BSenate Bill 525-First Edition General Assembly Of North Carolina Session 2023 (c) A controller or processor is not in violation of this Chapter if:

(1) Writtennoticeidentifyingeach provision ofthis Chapterthe AttorneyAttorneyGeneral General alleges the controller or processor has violated or is violating.

(g) If more than one controller or processor are involved in the same processing in violation of this Chapter, the liabilityliabilityfor for the violation shall be allocated among the controllers or processors in proportion to the comparative fault of each controller or processor.

(a) There is created a restricted account known as the "Consumer Privacy Account." The account shall be funded bybymoneyreceived money received through civil enforcement actions under this Chapter.

DRS35199-LR-18BSenate Bill 525-First Edition Page 11 General Assembly Of North Carolina Session 2023 (b) Upon appropriation by the General Assembly, the account funds may be used by the Attorney General for these purposes:

(3) Providing consumer and business education regarding consumer rights under this ChapterandChapterandcompliancewith compliancewith theprovisions ofthis Chapterforcontrollers and processors.

(a) The Attorney General and the Division shall compile a report evaluating the liability and enforcement provisions of this Chapter, includingincludingthe the effectiveness of the AttorneyAttorneyGeneral's General's and the Division's efforts to enforce this Chapter and summarizing the data protected and not protected bybythis this Chapter, including, with reasonable detail, a list of the types of information that are publicly available from State, local, and federal government sources.

Page 12 DRS35199-LR-18BSenate Bill 525-First Edition