HB 367 — An Act relating to the privacy of consumer personal information; establishing the Consumer Personal Information Privacy Act; establishing data broker registration requirements; relating to social security numbers; making certain violations unfair or deceptive trade practices; and providing for an effective date.

HB 367 -4- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (e) A business shall include on an Internet website page dedicated to consumers the content required under (b) and (c) of this section and reasonably ensure that consumers are directed to the alternative Internet website.

(f) In this section, "home page" means (1) the introductory page of an Internet website where personal information is collected;

(2) in the case of a mobile application, the application's platform page or download page, an electronic link within the application, and any other location that allows consumers to review the notice required by (a) of this section.

ConsumerLimits rights.on use, processing, collection, sharing, and retention of personal information.

(a) A consumerbusiness hasthat collects a consumer's personal information shall limit its collection and sharing of the rightpersonal toinformation (1)with confirmthird whetherparties ato controllerwhat is collectingreasonably ornecessary processingfor the consumer'sbusiness personalto dataprovide anda accessservice or conduct an activity that personala data;consumer has requested, or has consented to, or that is reasonably necessary for security or fraud prevention.

(2)In obtainthis fromsubsection, a"reasonably controllernecessary afor listsecurity ofor specificfraud thirdprevention" parties,does othernot thaninclude naturalprofiting persons,financially tofrom which the controller has transferred either (A) the consumer's personal data;information.

or(b) (B)A anybusiness that collects a consumer's personal data;information is not required to retain personal information collected for a single one-time transaction if the business does not sell or disclose the information.

(3)(c) correctExcept inaccuraciesfor in the consumer'scollection and sharing of personal data,information takingunder into(a) accountof this section, a business shall limit the naturebusiness's use and retention of thecollected personal datainformation andto thewhat purposesis ofreasonably thenecessary processingto ofprovide thea consumer'sservice personalor data;conduct an activity that a consumer has requested or consented to, or for a related operational purpose;

(4)however, delete personal datainformation providedthat by,is collected or obtainedretained about,solely thefor consumer,security includingor personalfraud dataprevention themay consumernot providedbe toused thefor controller,operational personalpurposes. data the controller obtained from another source, and data derived from the personal data;

(5) obtain a copy of the consumer's personal data collected or processed by the controller, in a portable and, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance if the processing is carried out by automated means;

and (6) opt out of the collection and processing of the consumer's personal data for purposes of (A) targeted advertising;

(B) the sale of personal data;

or (C) profiling in furtherance of automated decisions that HB0367b -3- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H produce legal or similarly significant effects concerning the consumer.

(b) A parent or legal guardian of a minor may exercise the minor's consumer rights under this section on the minor's behalf.

A guardian or conservator of a consumer subject to a guardianship, conservatorship, or other protective arrangement may exercise the consumer's rights under this section on the consumer's behalf.

(c) A consumer may designate another person to serve as the consumer's authorized agent, and act on the consumer's behalf, to exercise the consumer's rights under this section.

A controller shall comply with a request from an authorized agent if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the agent's authority to act on the consumer's behalf.

(d) A controller or processor may not collect, process, or transfer personal data in a manner that discriminates against an individual or class of individuals, or otherwise makes unavailable the equal enjoyment of goods or services, based on an individual's or class of individuals' actual or perceived race, color, sex, sexual orientation, gender identity, disability, religion, ancestry, or national origin.

This subsection does not apply to (1) the collection, processing, or transfer of personal data for the sole purpose of (A) self-testing by a controller or processor to prevent or mitigate unlawful discrimination or otherwise to ensure compliance with state or federal law;

or (B) diversifying an applicant, participant, or customer pool;

or (2) a private establishment as described in 42 U.S.C.

2000a(e).

ControllerNotification responsesof tobusiness consumerupon requests.receipt or disclosure of personal information.

(a) AWhen consumera mayperson exercisereceives personal information for a consumerbusiness rightpurpose underor AScommercial 45.48.805purpose bythat a securebusiness andoriginally reliablecollected meansfrom establisheda byconsumer, the controllerperson andshall describednotify tothe business that the consumerperson inpossesses the controller'spersonal privacyinformation notice.and provide the person's contact information.

The meansperson establishedshall byprovide theupdated controllercontact mustHB0367a take-5- intoHB account367 theNew waysText thatUnderlined a[DELETED consumerTEXT normallyBRACKETED] interacts34-LS1485\N withinformation the controller, the need for secure and reliable communication of a consumer request, and the ability of the controller to verify the identitybusiness ofif the consumerperson's makingcontact theinformation request.changes.

(b) A controllerperson maywho notreceives requirepersonal information that a consumerbusiness tooriginally createcollected from a newconsumer, accountand towho exercisediscloses athe consumerpersonal right,information butto mayanother requireperson for a consumerbusiness topurpose CSHBor 367(JUD)commercial -4-purpose, HB0367bshall Newnotify Textthe Underlinedbusiness [DELETEDthat TEXToriginally BRACKETED]collected 34-LS1485\Hthe useinformation annot existinglater account.than 10 days after the disclosure.

(b)The Innotification additionmust toinclude otherthe meanscontact establishedinformation byof the controller,person a controller shall allow a consumer to exercisewhom an opt-out request under AS 45.48.805(a)(6) by providing (1) a clear and conspicuous "Do Not Sell My Personal Information" or similarly worded link on the homepersonal pageinformation ofwas thedisclosed. controller's Internet website;

and(c) (2)A anperson opt-outthat preferencereceives signalpersonal sentinformation tothat thea controller,business withoriginally thecollected consumer'sfrom consent, by a platform,consumer technology,shall oreither mechanismde-identify used by the consumerpersonal thatinformation isor consumer-friendlymaintain and easy for the averagepersonal consumerinformation toin usea andway that allows the controllerperson tocan reasonablyreadily determinecomply whetherwith the consumer is a residentdisclosure ofor thedeletion staterequest andunder whetherAS the45.48.800 consumer- has45.48.945. made a legitimate opt-out request;

the use of an Internet protocol address to estimate the consumer's location is sufficient to reasonably determine residency under this paragraph.

(c) If a consumer's opt-out request under (b)(1) or (2) of this section conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's financial incentive program offered under AS 45.48.840, the controller shall comply with the consumer's opt-out preference provided under (b)(1) or (2) of this section but may notify the consumer of the conflict and provide to the consumer the choice to confirm the controller-specific privacy setting or participation in the program.

If a controller responds to a consumer opt‐out request under (b)(1) or (2) of this section by informing the consumer of a change in the price, rate, level, quality, or selection of goods or services, the controller shall present the terms of any financial incentive offered under AS 45.48.840 for the retention, processing, sale, or transfer of the consumer's personal data.

(d) Except as otherwise provided in AS 45.48.800 - 45.48.898, a controller shall comply with a request by a consumer to exercise the consumer's rights as follows:

(1) a controller shall respond to the consumer without undue delay, but not later than 45 days after receiving the request;

the controller may extend the response period by 45 additional days when reasonably necessary, considering the complexity and number of the consumer's requests, if the controller informs the HB0367b -5- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H consumer of the extension and the reason for the extension within the initial 45-day response period;

(2) if a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but not later than 45 days after receiving the request, of the justification for declining to take action and provide instructions for how to appeal the decision;

(3) a controller shall provide information in response to a consumer request free of charge once for each consumer during any 12-month period;

if a request from a consumer is manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request;

the controller bears the burden of demonstrating that the request is manifestly unfounded, excessive, or repetitive;

(4) if a controller is unable to authenticate a request to exercise a right afforded by AS 45.48.805(a)(1) - (5) using commercially reasonable efforts, the controller is not required to comply with a request to initiate an action under this section and shall provide notice to the consumer that the controller is unable to authenticate the request until the consumer provides additional information reasonably necessary to authenticate the consumer and the consumer's request;

(5) a controller may not require a consumer to authenticate to exercise an opt-out request under AS 45.48.805(a)(6), but a controller may deny an opt-out request if the controller has a good faith, reasonable, and documented belief that the request is fraudulent;

if a controller denies an opt-out request because the controller believes the request is fraudulent, the controller shall send a notice to the person who made the request disclosing that the controller believes the request is fraudulent, why the controller believes the request is fraudulent, and that the controller will not comply with the request;

(6) a controller that has obtained a consumer's personal data from a source other than the consumer complies with a consumer's request to delete the data under AS 45.48.805(a)(4) if the controller (A) deletes the consumer's personal data retained by the CSHB 367(JUD) -6- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H controller;

(B) retains a record of the deletion request and the minimum data necessary to ensure the consumer's personal data remains deleted from the controller's records;

and (C) does not use retained data for any other purpose.

(e) A controller shall establish a process for a consumer to appeal the controller's refusal to take action on a request within a reasonable period after the consumer receives the decision refusing to take action.

The appeal process must be conspicuously available and similar to the process for the consumer to submit requests under this section.

Not later than 60 days after receiving an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

If the appeal is denied, the controller shall provide the consumer with an online mechanism, if available, or another method by which the consumer may contact the attorney general to submit a complaint.

(f) A controller may not condition, expressly or effectively, or attempt to condition the exercise of a consumer right under this section through the use of (1) a false, fictitious, fraudulent, or materially misleading statement or representation;

or (2) a dark pattern.

(g) A controller or processor is not required to comply with an authenticated consumer rights request if the controller or processor (1) is not reasonably capable of associating the request with the personal data or it would be unreasonably burdensome for the controller or processor to associate the request with the personal data;

and (2) does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer.

45.48.812.

Duty of loyalty.

A controller may not perform an activity related to the collection, processing, or transfer of personal data that (1) conflicts with the best interests of an individual;

HB0367b -7- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H (2) takes advantage of or otherwise exploits an individual;

(3) results in a disproportionate risk to an individual;

(4) is to the detriment of an individual;

or (5) causes harm to an individual.

Sec.

DataRequired minimizationrecords. rules and de-identified data.

(a) A controllerbusiness shallthat limitcollects theor collection,has processing,collected and transfer of personal datainformation tofrom thata whichconsumer isshall reasonably necessary to provide or maintain (1)records aof specificeach productperson or service requested by the consumer to whom the databusiness pertainsdiscloses andthe relatedpersonal routineinformation. administrative, operational, or account-servicing activity, including billing, shipping, delivery, storage, or accounting;

orThe (2)business ashall communication,also othermaintain thanall anrecords advertisement,provided by the controller to the consumerbusiness reasonablyunder anticipatedAS within45.48.810(a) the context of the relationship between the controller and the(b). consumer.

(b) A controller may process or transfer personal data collected under (a) of this section to provide first-party advertising or targeted advertising, except when otherwise prohibited under AS 45.48.800 - 45.48.898.

(c) A controller that possesses de-identified data shall (1) take technical measures to ensure that the data cannot be associated with an individual;

(2) publicly commit to maintaining and using de-identified data without attempting to reidentify the data;

and (3) contractually obligate a recipient of the de-identified data to comply with the provisions of AS 45.48.800 - 45.48.898.

(d) A controller that transfers de-identified data shall exercise reasonable oversight to monitor compliance with contractual commitments to which the de- identified data is subject and shall take appropriate steps to address a breach of those contractual commitments.

(e) A controller or processor is not required to (1) reidentify de-identified data;

or (2) maintain data in an identifiable form.

SensitiveRequest data.for disclosure of collected personal information.

(a) A controllerconsumer may notrequest collect,a process,business orthat CSHBcollects 367(JUD)or -8-collected HB0367bthe Newconsumer's Textpersonal Underlinedinformation [DELETEDto TEXTdisclose BRACKETED] 34-LS1485\H transfer sensitive data pertaining to athe consumer unless(1) the collection,categories processing,and orspecific transferpieces isof strictlypersonal necessaryinformation tothat providethe orbusiness maintaincollects a specific product or servicecollected requestedwithin by the consumerfive toyears whompreceding the sensitivedate dataof pertains.the request;

(b)(2) Athe controllersources mayfrom notwhich sellthe sensitivebusiness data.collects or collected each category of personal information;

(c)and A(3) controllerthe maybusiness notpurpose transferor sensitivecommercial datapurpose pertainingfor tothe acollection consumerof withouteach firstcategory obtainingof thepersonal consumer'sinformation. affirmative consent.

(b) A controllerbusiness shall providerespond anto effective mechanism for a consumer torequest revokeunder thethis consumer'ssection affirmative consent that is at least as easyrequired asby theAS mechanism45.48.850. the consumer used to provide the consumer's affirmative consent and, on revocation of the consumer's affirmative consent, the controller shall discontinue processing the data as soon as practicable, but not later than 15 days after receiving the consumer's revocation of affirmative consent.

(d) Notwithstanding any other provision of AS 45.48.800 - 45.48.898, a controller that knows or reasonably should know that a consumer is a minor may not (1) process or transfer personal data of the minor for targeted advertising;

or (2) sell the personal data of the minor.

PrivacyRequest noticefor anddeletion disclosures.of personal information.

(a) A controllerconsumer shallmay providerequest a business to delete any of the consumer's personal information collected by the business from the consumer withwithin athe reasonablyfive accessible,years clear,preceding andthe meaningfuldate privacyof notice.the request.

The(b) privacyUpon noticereceiving musta includeconsumer (1)request theunder categoriesthis ofsection, personala databusiness collectedshall andHB processed367 by-6- theHB0367a controllerNew andText aUnderlined separate[DELETED listTEXT ofBRACKETED] categories34-LS1485\N ofdelete sensitivefrom datathe collectedbusiness's andrecords processed by the controller,information describedidentified in a level of detail that provides the consumerrequest. a meaningful understanding of the type of personal data collected or processed;

(2)(c) theWithin purpose45 ofdays collectingafter anda processingconsumer's eachdeletion categoryrequest, ofa personalbusiness datathat thereceives controllera collectsdeletion orrequest processes,under described(b) inof athis waysection thatshall givesdirect theall consumerpersons to whom a meaningfulbusiness understandingdisclosed ofrecords howunder eachAS category45.48.810 ofto delete the personal datainformation willand beprovide used;a written statement verifying that the information has been deleted.

(3)A howperson ashall consumercomply maywith exercisea thedirection consumer's rights under ASthis 45.48.800subsection. - 45.48.898, including how a consumer may appeal a controller's decision about the consumer's request;

(4)The thebusiness categoriesshall ofimmediately personalprovide datawritten thatnotification to the controllerattorney transfersgeneral toand the consumer of a thirdperson party,who iffails applicable,to andprovide thewritten purposeverification of thatcompliance. transfer;

HB0367b(d) -9-A CSHBperson 367(JUD)is Newnot Textrequired Underlinedto [DELETEDdelete TEXTpersonal BRACKETED]information 34-LS1485\Hunder (5)(c) the categories of thirdthis parties,section if any,the person maintains the personal information to which(1) complete the controllertransaction transfersfor which the personal data;information was collected;

(6)(2) theprovide lengtha ofgood timeor theservice controllerrequested intendsor toreasonably retainanticipated eachwithin categoryan ofongoing personalbusiness datarelationship or,with if it is not possible to identify the lengthconsumer; of time, the criteria used to determine the length of time the controller intends to retain each category of personal data;

and(3) (7)fulfill anthe activeterms electronicof maila addresswritten warranty or otherproduct onlinerecall mechanismconducted thatin theaccordance consumerwith mayfederal uselaw; to contact the controller.

(b)(4) Ifperform a controllercontract makesbetween a material change to the controller'sbusiness privacy notice, the controller shall, before implementing the material change for prospectively collected personal data, notify each consumer affected by the material change and provideconsumer; a reasonable opportunity for each consumer to withdraw consent.

A(5) controllerdetect shallsecurity provideincidents, aprotect reasonableagainst opportunitymalicious, fordeceptive, eachfraudulent, consumeror toillegal provideactivity, affirmative consent to further materially different processing or transferprosecute ofthe previouslyperson collectedresponsible personalfor datathat underactivity; the changed policy.

The(6) controlleridentify shalland takerepair allerrors reasonablethat measuresimpair to provide to each affected consumer direct electronic notification about material changes to the privacyexisting notice,intended takingfunctionality intoof accounta availableproduct technologyor andservice; the nature of the relationship.

(c)(7) Ifexercise a controllerright sellsprovided personal data to a third party or processes personal data for targetedby advertising,law, including the controllerright shallunder clearly and conspicuously disclose that sale or processing, as well as the mannerFirst inAmendment whichof a consumer may exercise the rightUnited toStates optConstitution outand ofart. that sale or processing.

I, sec.

5, of the Constitution of the State of Alaska to freedom of speech, or ensure the right of another consumer to exercise that consumer's right to freedom of speech;

(8) comply with a search warrant, subpoena, or court order;

(9) engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if (A) the deletion of information is likely to seriously impair or render impossible the achievement of the research;

and HB0367a -7- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (B) the consumer has provided consent to the research;

(10) enable solely internal uses that are reasonably aligned with the consumer's expectations, based on the consumer's relationship with the business;

or (11) comply with a legal obligation.

(e) A person may not disclose personal information that a business collected from a consumer unless the personal information is disclosed in accordance with a contract that requires the recipient to comply with a deletion request issued under AS 45.48.800 - 45.48.945.

ResponsibilitiesRequest for disclosure of processorspersonal andinformation controllers.sold or disclosed for a business purpose or commercial purpose.

(a) A processorconsumer shallmay adhererequest tothat the instructions of a controllerbusiness andthat assistsold theor controllerdisclosed in meeting the controller'sconsumer's obligationspersonal underinformation ASfor 45.48.800a -business 45.48.898,purpose takingor intocommercial accountpurpose thewithin nature of the processinglast andfive theyears informationdisclose available to the processor,consumer including by (1) usingthe appropriatethird technicalparties andsubject organizational measures, to theAS extent45.48.810 reasonablyin practicable,possession toof fulfill the controller'sconsumer's obligationpersonal toinformation; respond to a consumer rights request;

(2) assisting the controllercategories inof meetingpersonal theinformation controller'sor obligationsspecific CSHBpieces 367(JUD)of -10-personal HB0367binformation Newthat Textwere Underlinedsold [DELETEDor TEXTdisclosed BRACKETED] 34-LS1485\H relating to theeach securitythird ofparty processingfor personal data and notification of a breachbusiness ofpurpose securityor ofcommercial thepurpose; system of the processor to meet the controller's obligations;

and (3) providingfor necessarythe informationthird parties to enablewhich the controllerbusiness todirectly conductdisclosed andthe documentconsumer's personal information for a databusiness protectionpurpose assessment.or commercial purpose, the business purpose or commercial purpose for disclosing each category of personal information.

(b) A controllerbusiness and a processor shall enterrespond intoto a contractconsumer torequest governunder thethis processor'ssection dataas processingrequired proceduresby forAS processing45.48.850. performed on behalf of the controller.

The contract must be binding and clearly set out instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties.

The processor shall adhere to the instructions of the controller and process and transfer the data the processor receives from the controller only to the extent necessary to provide a service requested by the controller, as set out in the contract.

The contract must also require that the processor (1) ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;

(2) at the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;

(3) at the reasonable request of the controller, make available to the controller information in the processor's possession that is necessary to demonstrate the processor's compliance with the obligations set out in AS 45.48.800 - 45.48.898;

(4) after providing the controller with an opportunity to object, engage a subcontractor under a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data if the processor engages a subcontractor;

(5) ensure that personal data that the processor receives from or on behalf of a controller not be combined with personal data that the processor receives from or on behalf of another person or collects from the interaction of the processor with an individual;

and (6) allow and cooperate with a reasonable assessment by the controller or the controller's designated assessor, or arrange for a qualified and independent HB0367b -11- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H assessor to conduct an assessment, of the processor's policies and technical and organizational measures in support of the obligations under AS 45.48.800 - 45.48.898, using an appropriate and accepted control standard or framework and assessment procedure, and provide a report of the assessment to the controller on request.

(c) Nothing in this section relieves a controller or processor from the liabilities imposed on the controller or processor by virtue of the controller's or processor's role in the processing relationship as described in AS 45.48.800 - 45.48.898.

(d) Whether a person is acting as a controller or processor with respect to a specific processing of personal data depends on the facts and the context in which the personal data is processed.

A person who is not limited in the person's processing of personal data under a controller's instructions, or who fails to adhere to those instructions, is a controller and not a processor with respect to that specific processing of data.

A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor.

If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor becomes a controller with respect to that processing.

DataRequest protectionnot assessments.to sell, share, or disclose personal information.

(a) BeforeA initiatingconsumer themay, processingat activity,any atime, controllerrequest shall conduct and document a databusiness protectionnot assessmentto forsell, eachshare, ofor disclose the controller'sconsumer's processingpersonal activitiesinformation thator presentsnot a heightened risk of harm to asell, consumer,share, includingor (1)disclose theparticular collectioncategories or processing of personal data for the purposeconsumer's ofpersonal targetedinformation. advertising;

(2)(b) If a business collects personal information from a consumer online and the saleconsumer uses a global privacy control, the business shall treat the use of the global privacy control as a valid request submitted by the consumer under (a) of this section HB 367 -8- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N not to sell, share, or disclose the consumer's personal data;information.

(3)In thethis processingsubsection, of(1) personal"extension" datameans fora thepiece purpose of profiling,software whencode thethat profilingenables presents a reasonablycomputer foreseeableapplication riskor ofprogram (A)to unfairperform oran deceptiveactivity treatmentthe of,application or havingprogram ancannot unlawfullydo disparateby effectitself; on, consumers;

(B)(2) financial,"global physical,privacy control" includes a browser extension, privacy setting, device setting, or reputationalother injurymechanism that communicates or signals the consumer's choice not to consumers;have the consumer's personal information sold, shared, or disclosed.

(C)(c) aA physicalconsumer ormay, otheras intrusionprovided onby theregulation solitudeadopted orunder seclusion,AS 45.48.915, authorize another person solely to request that a business not sell, share, or disclose the privateconsumer's affairspersonal orinformation, concerns,and ofa consumers,business whenshall comply with the intrusionrequest wouldreceived befrom offensivethe toperson afor reasonablethe person;consumer.

or(d) CSHBA 367(JUD)business -12-shall HB0367brespond Newto Texta Underlinedconsumer [DELETEDrequest TEXTunder BRACKETED]this 34-LS1485\Hsection (D)as otherrequired substantialby injuryAS to45.48.850, consumers;unless the consumer later provides a clear and explicit renunciation of the request.

andFor (4)one theyear collectionafter orreceiving processinga request under (a) - (c) of sensitivethis data.section, a business may not contact the consumer to request that the consumer renounce the request.

(b)(e) A singlebusiness datasubject protectionto assessmentthis section may addressonly use the personal information collected from a comparableconsumer setrequest ofunder processingthis operationssection thatto includecomply similarwith activities.the request, unless otherwise authorized by the consumer or by another provision of law.

(c) A data protection assessment conducted under this section must (1) identify the categories of personal data collected, the purposes of collecting the personal data, and whether personal data is being transferred;

(2) consider the use of de-identified data, the reasonable expectations of consumers, the context of the processing, and the relationship between the controller and the consumer whose personal data will be processed;

and (3) identify and weigh the benefits resulting, directly or indirectly, from the processing activity to the controller, the consumer, other stakeholders, and the public against the potential risks to the consumer's rights, as mitigated by safeguards that are employed by the controller to reduce those risks.

(d) Not later than 30 days after completing a data protection assessment under this section, a controller shall submit a report of the data protection assessment or evaluation to the attorney general.

The report must include a summary of the data protection assessment.

The controller shall make the summary publicly available on the controller's Internet website or another place that is easily accessible to consumers.

A controller may redact confidential or proprietary information from the report.

The attorney general may require a controller to disclose a data protection assessment that is relevant to an investigation conducted by the attorney general, and the controller shall make the data protection assessment available to the attorney general.

The attorney general may evaluate the data protection assessment for compliance with the controller's responsibilities under AS 45.48.800 - 45.48.898.

To the extent information contained in a data protection assessment disclosed to the attorney general includes information subject to attorney-client privilege or protection under the work product doctrine, the disclosure does not constitute a waiver of the privilege or protection.

(e) A data protection assessment conducted by a controller for the purpose of complying with another applicable law satisfies the requirements in this section if the data protection assessment is reasonably similar in scope and effect to the data HB0367b -13- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H protection assessment that would otherwise have been conducted under this section.

(f) A controller shall review and update the data protection assessment as often as appropriate considering the type, amount, and sensitivity of personal data collected or processed and level of risk presented by the processing, throughout the duration of the processing activity, (1) to monitor for harm caused by the processing and adjust safeguards accordingly;

and (2) to ensure that data protection and privacy are considered as the controller makes new decisions with respect to the processing.

Discrimination,Use retaliation, and financialdisclosure incentives.of precise geolocation data.

(a) A controllerbusiness may notuse discriminatea orconsumer's retaliateprecise againstgeolocation adata consumer for exercisingother apurposes consumerthan rightthe purpose disclosed under AS 45.48.80045.48.800(a) -if 45.48.898the orconsumer refusingconsents to agree to the collectionuse. or processing of personal data for a separate product or service, including by (1) denying goods or services;

(2)A chargingconsumer differentwho pricesconsents orto ratesthe use of the consumer's precise geolocation data for goodsother orpurposes services;may, at any time, request that the business stop using the data for other purposes.

(3)The providingconsumer's aconsent differentmust levelbe ofin qualitywriting ofand goodsin oran servicesagreement separate from any other agreement for use, and the consumer must agree to athe consumer.business's use of the consumer's precise geolocation data for other purposes.

(b) AExcept controlleras isprovided notin required(a) toof providethis section, a productbusiness orshall servicelimit thatthe requiresuse and disclosure of a consumer's personalprecise geolocation data to that thenecessary controllerto doesprovide notgoods collector services that a consumer requests and reasonably expects, or maintain.goods and services the HB0367a -9- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N business reasonably expects the consumer will request.

(c) NotwithstandingThe (a)provisions of thisAS section,45.48.800 a- controller45.48.945 maydo offernot apply to a consumerbusiness athat differentuses price,a rate,consumer's level,precise quality,geolocation ordata selection of goods or services, including goods or services for no fee, if the offerconsumer is madean inemployee, connectioncontractor, with a consumer's voluntary participation in a financial incentive program, such as a bona fide loyalty, rewards, premium features, discount, or clubvendor cardof program.the business.

A controller that offers a financial incentive program under this subsection may not (1) transfer personal data to a third party as part of the program unless (A) the transfer is functionally necessary to enable the third party to provide a benefit to which the consumer is entitled;

(B) the transfer of personal data to the third party is clearly disclosed in the terms of the program;

and (C) the third party uses the personal data only for purposes of CSHB 367(JUD) -14- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H facilitating a benefit to which the consumer is entitled and does not process or transfer the personal data for any other purpose;

(2) consider the sale of personal data as functionally necessary to provide the program;

(3) use financial incentive practices that are unjust, unreasonable, coercive, or usurious.

TransferTreatment of informationindividuals in16 ayears businessof changeage transaction.or under.

(a) ANotwithstanding controllerany mayother transferprovision toof orAS share45.48.800 with- a45.48.945, third party a consumer'sbusiness personalthat datahas asactual anknowledge asset that is part of a businessconsumer changeis transaction16 if,years withinof aage reasonableor timeunder beforemay sharingnot or(1) transferringdisclose the personal data,information of the controllerconsumer providesfor ana affectedbusiness consumerpurpose withor (1)commercial apurpose, noticeor describinguse the businessconsumer's changeprecise transaction,geolocation includingdata thefor namea ofpurpose theother thirdthan partyto receivingprovide goods or services that the consumer'sconsumer personalreasonably datarequests and expects, unless the applicableconsumer's privacyparent policiesor ofguardian consents to the thirddisclosure party;or use;

andor (2) asell reasonableor opportunityshare to (A) withdraw the previouslypersonal providedinformation consentof related to the consumer'sconsumer. personal data;

and(b) (B)A requestbusiness thethat deletionrecklessly disregards a reasonable likelihood that a consumer is 16 years of age or under is considered to have actual knowledge of the consumer's personalage. data.

(b)In Ifthis asubsection, controller"recklessly" shareshas athe consumer'smeaning personalgiven data with a third party in theAS process11.81.900(a). of evaluating and consummating a business change transaction, the controller shall require that the third party agree by contract to keep the personal data confidential and not use the personal data for a purpose other than evaluating and consummating the transaction.

(c) A thirdbusiness party under (a) of this section may not usetrack or shareprofile the consumer's personal datainformation inof aan mannerindividual thatwho is materially16 inconsistentyears with (a) of thisage section or withunder thein privacyorder policyto ofprovide to the thirdindividual partya providedcommercial toadvertisement thethat consumeris inbased on the notificationpersonal requiredinformation underor (a)online activity of thisthe section.individual.

(d) A transfer under (a) of this section does not authorize a controller to make material retroactive privacy policy changes or other changes in a manner that constitutes an unfair or deceptive trade practice under AS 45.50.471 - 45.50.561.

(e) In this section, "business change transaction" means a merger, acquisition, HB0367b -15- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H bankruptcy, or other transaction in which the third party assumes control of some or all of the controller's assets.

SecurityDisclosure proceduresor anddeletion practices.request;

(a)process. A controller shall implement and maintain reasonable administrative, technical, and physical security procedures and practices to protect the confidentiality, integrity, and accessibility of personal data that are appropriate to the volume and nature of the data.

The(a) securityA proceduresbusiness andshall practicesrespond adoptedto by a controllerconsumer mustrequest includeunder aAS retention45.48.820 scheduleor that45.48.830 requiresby the(1) deletionproviding ofthe personalrequested datainformation whenelectronically to the dataconsumer isin requireda toportable beand, deletedto bythe lawextent ortechnically isfeasible, noreadily longeruseable necessaryformat forthat allows the purposeconsumer forto whichtransmit the datainformation wasto collected,another processed,person orwithout transferred.hindrance;

(b)(2) Aif processorthe shallinformation establish,provided implement,under and(1) maintainof reasonablethis administrative,subsection technical,is andnot physicalin dataa securityhuman-readable practicesformat, toproviding protect the confidentiality,requested integrity,information and accessibility of personal data appropriate to the volumeconsumer andin naturea offormat thethat personalis dataeasily atreadable issue.by a human;

and (3) at the consumer's request, providing the requested information by mail.

HB 367 -10- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (b) A business subject to AS 45.48.800 - 45.48.945 shall designate at least two methods for a consumer to submit a request under AS 45.48.820 - 45.48.835, including, at a minimum, a toll-free telephone number and an electronic mail address.

If a business maintains an Internet website, the website must include an option to submit requests under AS 45.48.820 - 45.48.835 on a public facing page.

A designated method for submitting requests may include a mailing address, electronic mail address, Internet website, Internet website portal, toll-free telephone number, other applicable contact information, or a new consumer-friendly means of contacting a business as determined by regulation.

(c) A person may not charge a consumer a fee for performing a duty required by AS 45.48.800 - 45.48.945.

(d) A person may only use the information provided by a consumer in a request made under AS 45.48.820 - 45.48.835 to identify the consumer and comply with the request.

(e) In response to a request made under AS 45.48.820 - 45.48.835, a business shall (1) promptly determine whether the request is a consumer request;

a business may not require that a consumer create an account with the business;

however, if the consumer maintains an account with the business, the business may require the consumer to submit the request through the account;

(2) identify in writing the personal information subject to a disclosure request;

the information disclosed must (A) cover the 12-month period preceding the request, or another applicable period designated by the consumer;

(B) be designated by the most relevant category of personal information;

(C) clearly separate information requested under AS 45.48.820 and 45.48.830;

(3) disclose and deliver the identified information in writing not later than 45 days after receipt of the request;

(4) not later than 45 days after receipt of a deletion request, comply HB0367a -11- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N with AS 45.48.825, and provide confirmation of compliance to the consumer.

(f) The time to respond to a disclosure or deletion request under (e)(3) and (4) of this section may be extended once for an additional 45 days when reasonably necessary.

If the time to respond is extended, the business shall notify the consumer of the extension.

(g) A business may disclose or provide confirmation of deletion of information to the consumer by mail, through the consumer's account with the business, or electronically at the consumer's request if the consumer does not have an account with the business.

(h) Notwithstanding any other requirement in this section, if a consumer's requests are manifestly unfounded or excessive, in particular because of the requests' repetitive character, a business may either charge a reasonable fee, taking into account the administrative costs of complying with the consumer's request, or refuse to act on the request.

The business shall notify the consumer of a decision to charge a fee or to deny a request within the timeline provided under (e)(3) and (4) and (f) of this section.

The notification must completely explain the business's reason for finding the request manifestly unfounded or excessive, including all pertinent facts.

The business shall bear the burden of proving that a consumer's request is manifestly unfounded or excessive.

(i) A business is not required to respond to a disclosure or deletion request under AS 45.48.825 or 45.48.830 if the consumer making the request has made two consumer requests in the previous 365 days.

(j) A business is not required under this section to re-identify or otherwise link data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information.

DataThird-party brokerdisclosure registration.and handling of personal information.

(a) BeforeA athird controllerparty beginsmay operatingnot asdisclose apersonal datainformation broker,to theanother controllerperson shallif registerthe withpersonal theinformation commissionerwas originally collected in accordanceviolation withof thisAS section.45.48.800 or 45.48.835.

(b)A Tothird registerparty asthat areasonably datainquires broker,into awhether controllerpersonal shallinformation (1)was provide,collected onin aviolation formof providedAS by45.48.800 theor commissioner,45.48.835, (A)and thereasonably nameconcludes that information was not obtained in violation of theAS data45.48.800 broker;HB 367 -12- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N or 45.48.835 may not be held liable for a violation under this section.

(B)(b) A third party may not disclose a consumer's personal information for a business purpose or commercial purpose unless the datathird broker'sparty primaryreceives physicalwritten andconfirmation mailingfrom addresses;the business that originally collected the personal information that the information was collected in compliance with AS 45.48.800 and 45.48.835.

(C) the data broker's electronic mail address;

(D) the data broker's primary Internet website address;

and (E) the Internet website address for the data broker's "Do Not Sell My Personal Information" Internet website page as required under AS 45.48.810(b);

and (2) pay a registration fee in an amount established by the department by regulation.

(c) The department shall deposit the fees paid under this section into the consumer privacy account established under AS 45.48.860.

(d) The commissioner shall make available on the department's Internet CSHB 367(JUD) -16- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H website a registry with the information provided by data brokers under this section.

ConsumerService privacyprovider account.obligations.

(a) TheA consumerservice privacyprovider accountmay isnot established(1) inretain, use, or disclose personal information received from a business for any purpose other than to perform the generalservices fund.specified in a written contract with the business;

Registration(2) feescombine collectedpersonal underinformation ASreceived 45.48.855from and civil penalties and money collected in or as a resultbusiness ofwith anpersonal actioninformation brought by the attorneyservice generalprovider underreceives ASfrom 45.48.800other -sources, 45.48.898unless shallotherwise beprovided depositedin intoregulation; the general fund and separately accounted for under AS 37.05.142.

(b)(3) Thedisclose legislaturepersonal mayinformation appropriatereceived thefrom annuala estimatedbusiness balanceto inany theother accountperson maintainedwithout underfirst AS(A) 37.05.142receiving towritten payconsent (1) the salaries of attorneys in the Departmentbusiness ofto Lawdisclose that enforce the provisionspersonal ofinformation ASto 45.48.800 - 45.48.898 at an amount that is competitive with the privateother sector;person;

and (2)(B) theentering administrativeinto costsa incurredwritten bycontract with the departmentother andperson that prohibits the Departmentother ofperson Lawfrom toengaging enforcein ASconduct 45.48.800prohibited -under 45.48.898.this section.

(b) A person who receives personal information from a service provider may not disclose the personal information to any other person.

Violations.Exemptions.

(a) A violation of AS 45.48.800 - 45.48.89845.48.945 do not apply to (1) protected health information that is ancollected unfairby ora deceptivecovered actentity or practicebusiness underassociate ASgoverned 45.50.471by -the 45.50.561.privacy, security, and breach notification rules issued by the United States Department of Health and Human Services in 45 C.F.R.

EachParts day160 ofand a164, violationestablished constitutesunder athe separateHealth violation.Insurance Portability and Accountability Act of 1996 (P.L.

(b)104-191) Inand anthe actionHealth broughtInformation underTechnology ASfor 45.50.531(a),Economic aand consumerClinical whoseHealth personalAct data(P.L. is subjected to unauthorized access, destruction, use, modification, or disclosure has suffered an ascertainable loss of money or property.

(c)111-5); The remedies provided under this section are in addition to the remedies provided under AS 45.48.080 for a violation of AS 45.48.010 - 45.48.090.

in this paragraph, "protected health information" has the meaning given in 45 C.F.R.

160.103;

(2) a covered entity governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human HB0367a -13- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N Services in 45 C.F.R.

Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996 (P.L.

104-191), to the extent the provider or covered entity maintains patient information in the same manner as medical information or protected health information as described in (1) of this subsection;

(3) information collected as part of a clinical trial subject to 45 C.F.R.

Part 46 (Protection of Human Subjects) under (A) good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;

or (B) human subject protection requirements of the United States Food and Drug Administration;

(4) vehicle information or ownership information retained or shared between a new motor vehicle dealer, as defined in AS 45.25.990, and the motor vehicle manufacturer, as defined in AS 45.25.990, if the information is shared for the purpose of or in anticipation of effectuating a vehicle repair covered by a vehicle warranty or recall conducted under 49 U.S.C.

30118 - 30120, if the new motor vehicle dealer or vehicle manufacturer does not sell, share, or use the information for another purpose;

in this paragraph, (A) "ownership information" means the name of each registered owner and accompanying contact information;

(B) "vehicle information" means the vehicle identification number, the vehicle's make, model, or year, or the vehicle's odometer reading;

(5) a person, including a subsidiary or affiliate of the person, and data that are subject to 15 U.S.C.

6801 - 6827 (Gramm-Leach-Bliley Act) and related regulations;

(6) an individual's personal information collected by a business if the business collects the personal information through the individual's (A) job application made to the business;

(B) service as an employee, officer, or director of the business;

or (C) work as a contractor for the business and consists only of HB 367 -14- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (i) personal information used solely within the context for which it was collected;

(ii) emergency contact information used solely for the purpose of having an emergency contact on file;

or (iii) personal information retained solely to administer benefits for the individual.

(b) AS 45.48.800 - 45.48.945 do not apply to the disclosure of a consumer's personal information to (1) comply with federal, state, or local law;

(2) comply with a civil, criminal, or regulatory inquiry or an investigation, subpoena, or summons by federal, state, or local authorities;

(3) cooperate with law enforcement agencies concerning conduct or activity that the person reasonably and in good faith believes may violate federal, state, or local law;

(4) exercise or defend legal claims;

(5) collect, use, retain, sell, or disclose de-identified consumer personal information or aggregated consumer personal information.

(c) AS 45.48.800 - 45.48.945 do not apply to the collection or sale of a consumer's personal information if the commercial conduct takes place wholly outside the state.

For the purpose of this subsection, commercial conduct takes place wholly outside the state if (1) the business collected the information while the consumer was outside the state;

the exemption allowed under this subsection does not include the storage of personal information, including on a personal device, while the consumer is in the state and collection when the consumer and stored information later leave the state;

(2) no part of the sale of the consumer's personal information occurred in the state;

and (3) no personal information collected while the consumer was in the state was sold.

(d) AS 45.48.800 - 45.48.875 and 45.48.885 - 45.48.945 do not apply to HB0367a -15- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (1) an activity that is subject to 15 U.S.C.

1681 - 1681x (Fair Credit Reporting Act) that involves the collection, maintenance, disclosure, sale, communication, or use of any personal information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living by a consumer reporting agency;

(2) a furnisher of information who provides information for use in a consumer report, or a user of a consumer report, to the extent the information is used as authorized under 15 U.S.C.

1681 - 1681x (Fair Credit Reporting Act);

(3) personal information collected, processed, sold, or disclosed under 18 U.S.C.

2721 - 2725 (Driver's Privacy Protection Act of 1994) and related regulations.

(e) Except as provided in AS 45.48.835 and 45.48.880, personal information contained in a written communication, oral communication, or transaction between a business and a consumer is exempt from AS 45.48.800 - 45.48.945 if (1) the consumer is an individual acting as an employee, owner, director, officer, member, or contractor of a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders, partners, members, or other owners, or is a government agency;

in this paragraph, "owner" means an individual who (A) owns, directly or indirectly, or has the power to vote, more than 50 percent of the outstanding shares of a class of voting securities of a business;

(B) controls, in any manner, the election of a majority of the directors or of individuals exercising similar functions;

or (C) has the power to exercise a controlling influence over the majority of the directors or of individuals exercising similar functions;

and (2) the communication or transaction occurs solely within the context of the business exercising due diligence regarding a product or service of, the receipt of a product or service from, or providing a product or service to the corporation, partnership, sole proprietorship, or government agency.

HB 367 -16- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (f) A requirement under AS 45.48.800 - 45.48.945 does not apply if (1) compliance with the requirement would violate an evidentiary privilege under state law;

(2) the business provides personal information as part of privileged communication to a person covered by an evidentiary privilege;

(3) the right or obligation would adversely affect a right of another consumer;

(4) the requirement would infringe on the noncommercial activity of a person or entity exercising rights under art.

I, sec.

5, Constitution of the State of Alaska.

(g) A business does not sell or share a consumer's personal information under AS 45.48.800 - 45.48.945 if (1) the consumer intentionally directs the business to disclose the consumer's personal information to a third party, intentionally uses the business to disclose the consumer's personal information to a third party, or intentionally directs the business to interact with a third party, and the third party does not also disclose the personal information or discloses the personal information consistent with AS 45.48.800 - 45.48.945;

(2) the business uses or shares a unique identifier for a consumer to alert third parties that the consumer has requested under AS 45.48.835 that the business not sell, share, or disclose the consumer's personal information or particular categories of the consumer's personal information.

(h) A business does not sell personal information under AS 45.48.800 - 45.48.945 when the business uses or shares with a service provider a consumer's personal information that is necessary to perform a business purpose if (1) the business has provided notice under AS 45.48.800 of the personal information being used or shared;

and (2) the service provider does not further collect, sell, or use the consumer's personal information except as necessary to perform the business purpose.

(i) In this section, (1) "contractor" means a person who is not an employee of a business HB0367a -17- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N but provides a service to the business under a written contract;

(2) "covered entity" has the meaning given in 45 C.F.R.

160.103;

(3) "director" has the meaning given in AS 10.06.990;

(4) "intentionally" does not mean hovering over, muting, pausing, or closing a piece of content;

(5) "officer" means a person appointed or designated as an officer of a corporation by or under applicable law or the corporation's articles of incorporation or bylaws, or a person who performs for the corporation the functions usually performed by an officer of a corporation.

Regulations.Retaliation prohibited;

Thefinancial attorneyincentives. general may adopt regulations under AS 44.62 (Administrative Procedure Act) to implement AS 45.48.800 - 45.48.898.

(a) A business may not retaliate against a consumer in response to a consumer exercising rights under AS 45.48.800 - 45.48.945.

Retaliation includes (1) denying goods or services;

(2) charging different prices or rates for goods or services, including using discounts or other benefits or imposing penalties;

(3) providing a different level or quality of goods or services to a consumer;

(4) suggesting that a consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

(b) Notwithstanding (a) of this section, a business may charge a consumer a different rate or provide a different level or quality of goods or services to a consumer if the difference is reasonably related to the value provided to the business by the consumer's personal information.

(c) Notwithstanding (a) of this section, a business may offer a consumer a financial incentive for the collection, sale, or retention of personal information, including direct payments to a consumer as compensation.

A business that offers a financial incentive under this subsection (1) shall notify consumers of the financial incentive;

(2) shall obtain a consumer's consent before entering a consumer into a financial incentive program;

to obtain a consumer's consent under this paragraph, the business shall provide the consumer access to a clear and conspicuous description of HB 367 -18- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N the material terms of the financial incentive program;

the consumer may revoke the consent at any time;

(3) may not use financial incentive practices that are unjust, unreasonable, coercive, or usurious.

(d) In this section, "business" does not include a newspaper.

Exemptions.Transfer of information in a merger, acquisition, bankruptcy, and certain other transactions.

(a) ASA 45.48.800business -may 45.48.898transfer do not apply to (1)or protectedshare healthwith information that a coveredthird entityparty ora businessconsumer's associatepersonal collectsinformation oras processesan inasset accordancethat with,is orpart documentsof that a covered entity or business associatechange createstransaction. for the purpose of complying with, the Health Insurance Portability and Accountability Act of 1996 (P.L.

104-191)(b) If a business shares a consumer's personal information with a third party in the process of evaluating and regulationsconsummating adopteda underbusiness change transaction, the business shall require that Act;the third party agree by contract to keep the personal information confidential and not use the personal information for a purpose other than evaluating and consummating the transaction.

in(c) A third party under (a) of this paragraph,section "businessmay associate,"not "covereduse entity,"or andshare "protectedthe healthconsumer's information"personal haveinformation in a manner that is materially inconsistent with (a) of this section or with the meaningsuses givenidentified in 45the C.F.R.notification made under AS 45.48.800.

160.103;(d) A transfer under (a) of this section does not authorize a business to make material retroactive privacy policy changes or other changes in a manner that constitutes an unfair or deceptive trade practice under AS 45.50.471 - 45.50.561.

HB0367b(e) -17-In CSHBthis 367(JUD)section, New"business Textchange Underlinedtransaction" [DELETEDmeans TEXTa BRACKETED]merger, 34-LS1485\Hacquisition, (2)bankruptcy, data collected, processed, or maintainedother thattransaction mustin bewhich retained to administer benefits for another individual relating to an individual who is the subjectthird ofparty protectedassumes healthcontrol information under (1) of thisall subsectionor andpart used for the purpose of administering the benefits;business.

(3) patient-identifying information under 42 U.S.C.

290dd-2;

(4) information that identifies a consumer that is collected, processed, or maintained in connection with (A) activities that are subject to 45 C.F.R.

Part 46 (Protection of Human Subjects);

(B) research on human subjects conducted under good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use;

(C) activities that are subject to the protections provided in 21 C.F.R.

Parts 50 and 56;

or (D) personal data used or shared in research, as that term is defined in 45 C.F.R.

164.501, that is conducted in accordance with the standards applicable under (A) - (C) of this paragraph or other research conducted in accordance with applicable law;

(5) information and documents created for purposes of 42 U.S.C.

11101 - 11152 (Health Care Quality Improvement Act of 1986) and related regulations;

(6) patient safety work product, as defined in 42 C.F.R.

3.20, that is created for purposes of improving patient safety under 42 C.F.R.

Part 3 (Patient Safety Organizations and Patient Safety Work Product) and 42 U.S.C.

299b-21 - 299b-26 (Patient Safety and Quality Improvement Act of 2005);

(7) information derived from health care-related information listed in this subsection that is de-identified in accordance with the requirements for de- identification under the Health Insurance Portability and Accountability Act of 1996 (P.L.

104-191) and related regulations;

(8) information collected, processed, or sold that is subject to 15 U.S.C.

6801 - 6827 (Gramm-Leach-Bliley Act) and related regulations;

CSHB 367(JUD) -18- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H (9) an activity that involves the collection, maintenance, disclosure, sale, communication, or use of any information bearing on a consumer's creditworthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living and that is subject to 15 U.S.C.

1681 - 1681x (Fair Credit Reporting Act), if the activity is performed by (A) a consumer reporting agency, as that term is defined in 15 U.S.C.

1681a(f);

(B) a person who furnishes information to a consumer reporting agency under 15 U.S.C.

1681s-2;

or (C) a person who uses a consumer report as provided in 15 U.S.C.

1681b(a)(3);

(10) personal data collected, processed, sold, or disclosed under 18 U.S.C.

2721 - 2725 (Driver's Privacy Protection Act of 1994) and related regulations;

(11) personal data regulated by 20 U.S.C.

1232g (Family Educational Rights and Privacy Act of 1974);

(12) personal data collected, processed, sold, or disclosed in compliance with 12 U.S.C.

2001 - 2279cc (Farm Credit System);

(13) data collected, processed, or maintained (A) in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role;

or (B) as the emergency contact information of an individual used for emergency contact purposes;

(14) personal data collected, processed, sold, or disclosed related to a price, route, or service of an air carrier, but only to the extent preempted by 49 U.S.C.

41713.

(b) AS 45.48.800 - 45.48.898 may not be construed to restrict the ability of a controller or processor to collect, process, transfer, or disclose a consumer's personal data to the extent necessary to (1) comply with federal, state, municipal, or tribal law;

HB0367b -19- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H (2) comply with a civil, criminal, or regulatory inquiry or an investigation, subpoena, or summons by federal, state, municipal, or tribal authorities;

(3) cooperate with a law enforcement agency concerning conduct or activity that the person reasonably and in good faith believes may violate federal, state, municipal, or tribal law;

(4) investigate, establish, exercise, or defend a legal claim;

(5) provide a product or service specifically requested by the consumer;

(6) perform under a contract to which the consumer is a party, including fulfilling the terms of a written warranty;

(7) take steps at the request of a consumer before entering into a contract;

(8) take immediate steps to protect an interest that is essential for the life or physical safety of an individual when the collection, processing, transfer, or disclosure cannot be manifestly justified using another legal basis;

(9) prevent, detect, protect against, or respond to a security incident or malicious, deceptive, fraudulent, or illegal activity or preserve the integrity or security of systems;

(10) engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all relevant laws and regulations governing that research and is approved, monitored, and governed by an institutional review board or similar independent oversight entity that determines whether (A) the deletion of personal data requested by a consumer under AS 45.48.805(a)(4) is likely to provide substantial benefits that do not exclusively accrue to the controller;

(B) the expected benefits of the research outweigh the privacy risks;

and (C) the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including risks associated with reidentification;

(11) assist another controller, processor, or third party with any CSHB 367(JUD) -20- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H obligations under AS 45.48.800 - 45.48.898;

(12) process personal data for reasons of public interest in the areas of public health, community health, or population health, but only to the extent that the processing is (A) subject to suitable and specific measures to safeguard the rights of the consumer whose personal data is being processed;

and (B) under the responsibility of a professional subject to confidentiality obligations under federal, state, municipal, or tribal law;

(13) ensure the data security and integrity of personal data as required by AS 45.48.800 - 45.48.898, protect against spam, or protect and maintain networks and systems, including through diagnostics, debugging, and repairs;

(14) carry out a product recall under federal or state law or to fulfill a warranty;

(15) conduct medical research in compliance with 45 C.F.R.

Part 46 (Protection of Human Subjects) or 21 C.F.R.

Parts 50 and 56;

or (16) process personal data previously collected in accordance with AS 45.48.800 - 45.48.898 to convert the personal data into de-identified data, including to (A) conduct internal research to develop, improve, or repair products, services, or technology;

(B) identify and repair technical errors that impair existing or intended functionality;

or (C) perform solely internal operations that are reasonably aligned with the expectations of the consumer or reasonably anticipated based on the consumer's existing relationship with the controller or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer or the performance of a contract to which the consumer is a party.

(c) A requirement under AS 45.48.800 - 45.48.898 does not apply if (1) compliance would violate an evidentiary privilege under state law;

(2) a controller or processor provides personal data as part of a HB0367b -21- CSHB 367(JUD) New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H privileged communication to a person covered by an evidentiary privilege;

(3) the right or obligation would adversely affect a right of another person;

(4) a person collects or processes personal data in the course of that person's purely personal or household activities;

(5) compliance would require a private school as defined in AS 14.45.200 or a private institution of higher education as defined in 20 U.S.C.

1001 to delete personal data when that deletion would unreasonably interfere with the school's provision of educational services or ordinary operations;

(6) compliance would require the affirmative collection of personal data about the age of users that a controller does not already collect in the normal course of business or require a controller to implement age restriction requirements or age verification.

(d) A controller may collect or process personal data under this section only to the extent that the collection or processing (1) is reasonably necessary for and proportionate to the purposes listed in this section or, in the case of sensitive data, strictly necessary for the purposes listed in this section;

(2) is limited to data that is necessary in relation to the specific purposes listed in this section;

(3) is subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data and to reduce reasonably foreseeable risks of harm to consumers related to the processing of personal data;

and (4) complies with AS 45.48.805(d).

(e) A controller that collects or processes personal data under an exemption in this section bears the burden of demonstrating that the collection or processing qualifies for the exemption and complies with the requirements of (d) of this section.

(f) A violation of AS 45.48.800 - 45.48.898 by a processor or third-party controller that receives and processes personal data from a controller or another processor is not imputed to the controller or processor that disclosed the personal data CSHB 367(JUD) -22- HB0367b New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H unless the disclosing controller or processor had actual knowledge that the receiving processor or third-party controller would commit the violation.

A violation of AS 45.48.800 - 45.48.898 by a controller or processor that discloses personal data to a third-party controller or processor is not imputed to the receiving third-party controller or processor.

ComponentDuty parts.to maintain reasonable security measures.

IfA abusiness seriesthat ofowns, stepslicenses, or transactionsmaintains area componentconsumer's partspersonal ofinformation ashall singleimplement transaction and aremaintain intendedreasonable fromsecurity theprocedures beginningand topractices avoidappropriate to the reachnature of ASthe 45.48.800 - 45.48.898, including a controller's disclosure of information to aprotect thirdthe party to avoid being considered a sale of personal data,information thefrom stepsunauthorized oraccess, transactionsdestruction, mayuse, notmodification, be considered separate for the purposes of determining compliance with, an exception to, or adisclosure. violation of AS 45.48.800 - 45.48.898.

ProvisionsComponent notparts. waivable.

AIf consumer'sa waiverseries of steps or transactions are component parts of a single transaction and are intended from the provisionsbeginning to avoid the reach of AS 45.48.800 - 45.48.89845.48.945, isincluding contrarya business's disclosure of HB0367a -19- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N information to publica policythird andparty isto unenforceableavoid andbeing void.considered a sale, the steps or transactions may not be considered separate for the purposes of determining compliance with, an exception to, or a violation of AS 45.48.800 - 45.48.945.

This section does not prevent a consumer from (1) declining to request information from a controller;

(2) declining to request that a controller not collect, sell, or disclose the consumer's personal data;

or (3) authorizing a controller to sell the consumer's personal data after previously requesting that the controller not sell the personal data.

LiberalViolations. construction.

The(a) intentA violation of AS 45.48.800 - 45.48.89845.48.945 is remedial,an andunfair itsor provisionsdeceptive shallact beor liberallypractice construed.under AS 45.50.471 - 45.50.561.

Each day of a violation constitutes a separate violation.

(b) In an action brought under AS 45.50.531(a), a consumer whose personal information is subjected to unauthorized access, destruction, use, modification, or disclosure has suffered an ascertainable loss of $1 or another amount proven at trial, whichever is greater.

(c) The remedies under this section are in addition to the remedies provided under AS 45.48.080 for a violation of AS 45.48.010 - 45.48.090.

Consumer privacy account.

(a) The consumer privacy account is established as a separate account in the general fund.

(b) The consumer privacy account consists of (1) money appropriated to the account by the legislature;

(2) the registration fees collected under AS 45.48.900(b)(2);

(3) the fees collected under AS 45.48.910;

and (4) civil penalties and money collected in or as a result of an action brought by the attorney general under AS 45.48.800 - 45.48.945.

(c) The purposes of the consumer privacy account are to pay (1) the salaries of attorneys in the Department of Law that enforce the provisions of AS 45.48.800 - 45.48.945 at an amount that is competitive with the private sector;

and (2) the administrative costs incurred by the department and the Department of Law to enforce AS 45.48.800 - 45.48.945.

(d) The legislature may appropriate money deposited under (b)(2) - (4) of this section for the purposes of the account.

Sec.

45.48.900.

Data broker registration.

(a) Before a business begins operating as a data broker, the business shall register with the commissioner in accordance with this section.

HB 367 -20- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N (b) To register as a data broker, a business shall (1) provide, on a form provided by the commissioner, (A) the name of the data broker;

(B) the data broker's primary physical and mailing addresses;

(C) the data broker's electronic mailing address;

(D) the data broker's primary Internet website address;

and (E) the data broker's "Do Not Collect or Sell My Personal Information" Internet website page as required under AS 45.48.800(c) or alternative Internet website page that meets the requirements of AS 45.48.800(d);

and (2) pay a registration fee in an amount established by the department by regulation.

(c) The department shall deposit the fees paid under (b)(2) of this section into the consumer privacy account established under AS 45.48.895.

Sec.

45.48.905.

Data broker registry publicly displayed.

The commissioner shall make the information provided by data brokers under AS 45.48.900(b)(1) available on the department's Internet website.

Sec.

45.48.910.

Revenue fees.

(a) A business that collects, sells, or shares personal information from a consumer shall pay a fee to the department.

The amount of this fee is three percent of the revenue received by the business from the buying, selling, or sharing of the personal information of a consumer or household information.

(b) The department shall deposit the fees paid under (a) of this section into the consumer privacy account established under AS 45.48.895.

Sec.

45.48.915.

Regulations.

(a) The attorney general shall adopt regulations under AS 44.62 (Administrative Procedure Act) that (1) create specific exceptions required to comply with state or federal law;

(2) govern the Internet website page requirement of AS 45.48.800, including (A) the use of a recognizable and uniform mark to identify the HB0367a -21- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N opportunity to exercise a right under AS 45.48.800 - 45.48.945;

(B) the submission of a consumer request;

(C) a business's compliance with a request under AS 45.48.835;

(3) update, as necessary, additional categories of personal information required to be disclosed in response to relevant changes in technology, data collection practices, privacy concerns, or obstacles to implementation;

(4) update, as necessary, the interpretation of unique identifiers in response to relevant changes in technology, data collection practices, privacy concerns, or obstacles to implementation;

(5) update, as necessary, the interpretation of designated methods for submitting requests to facilitate a consumer's ability to obtain information from a business;

(6) establish requirements to ensure that notices and information provided under AS 45.48.800 are in plain language, accessible to consumers with disabilities, and available in the language primarily used by the business to interact with the consumer, including with regard to financial incentive offerings;

(7) designate the process for a consumer to authorize a representative to exercise the rights provided under AS 45.48.800 - 45.48.945 on the consumer's behalf;

and (8) further define the meaning of "profile." (b) The attorney general may adopt regulations under AS 44.62 (Administrative Procedure Act) that (1) establish rules and procedures for processing and complying with a consumer request for specific pieces of personal information relating to a household to address obstacles to implementation and privacy concerns;

(2) state that service providers may combine personal information for specified purposes;

(3) are necessary to further the purposes of AS 45.48.800 - 45.48.945.

(c) The department shall establish by regulation adopted under AS 44.62 (Administrative Procedure Act) the amount of the registration fee that a data broker shall pay under AS 45.48.900(b)(2).

HB 367 -22- HB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N Sec.

45.48.920.

Persons who may consent.

Except as provided in AS 45.48.845(a), a person may provide consent for a consumer under AS 45.48.800 - 45.48.945 if the person is (1) the consumer;

(2) the consumer's legal guardian;

(3) a person who holds a power of attorney for the consumer;

or (4) a person who is acting as a conservator for the consumer.

Sec.

45.48.925.

Personnel training.

A business subject to AS 45.48.800 - 45.48.945 shall provide training to individuals responsible for handling consumer questions or requests under AS 45.48.800 - 45.48.945, including training the individuals how to direct a consumer to exercise the consumer's rights under AS 45.48.800 - 45.48.945.

Sec.

45.48.930.

Provisions not waivable.

A consumer's waiver of the provisions of AS 45.48.800 - 45.48.945 is contrary to public policy and is unenforceable and void.

This section does not prevent a consumer from (1) declining to request information from a business;

(2) declining to request that a business not collect, sell, or disclose the consumer's personal information;

or (3) authorizing a business to sell the consumer's personal information after previously requesting that the business not sell the personal information.

Sec.

45.48.935.

Liberal construction.

The intent of AS 45.48.800 - 45.48.945 is remedial and its provisions shall be liberally construed.

Sec.

45.48.940.

In AS 45.48.800 - 45.48.898,45.48.945, unless the context clearly indicates otherwise, (1) "affiliate""aggregated consumer information" means information that relates to a legalgroup entityor thatcategory sharesof commonconsumers brandingfrom withwhich anotherindividual legalconsumer entityidentities orhave controls,been removed, and that is controllednot by,linked or isreasonably underlinkable commonby controla withdevice anotheror legalother entity;method to a consumer or household;

in"aggregated thisconsumer paragraph,information" "control"does andnot "controlled" mean havingan (A)individual ownershipconsumer of,record orthat thehas powerbeen tode-identified; vote, more than 50 percent of the outstanding shares of any class of voting security of a legal entity;

(B)(2) control"application" inmeans anya mannercomputer oversoftware thepackage electionthat ofperforms a majorityspecific offunction; the directors or of individuals exercising similar functions;

orHB0367a (C)-23- theHB power367 toNew exerciseText controllingUnderlined influence[DELETED overTEXT theBRACKETED] HB0367b34-LS1485\N -23-(3) CSHB"beacon" 367(JUD)means Newa Textsmall Underlinedcomputer [DELETEDdevice TEXTthat BRACKETED]allows 34-LS1485\Hcomputer managementinformation ofto be transmitted to a legalportable entity;device that can connect to the Internet;

(2)(4) "affirmative"business" consent" (A) means a clearsole affirmativeproprietorship, actpartnership, signifyinglimited aliability consumer'scompany, freelycorporation, given,association, specific,or informed,other andlegal unambiguousentity authorizationthat is organized or operated for anthe actprofit or practice,financial afterbenefit havingof beenits informed,shareholders, partners, members, or other owners, that collects or has collected consumers' personal information or on the behalf of which that information is collected, that alone or jointly with others determines the purposes and means of processing personal information of consumers, that does business in responsethe tostate, aand specificthat request(A) fromsatisfies aone controller;or both of the following thresholds:

(i) alone or in makingcombination thewith request,another theperson, controllerannually shallbuys, (i)sells, provideor toshares the consumerpersonal ainformation clearof and100,000 conspicuousor stand-alonemore disclosure;consumers or households;

or (ii) providederives to50 thepercent consumer a written request that describes the processing purpose for which the consumer's consent is sought, that clearly distinguishes between an act or practicemore that is necessary to fulfill a request of theits consumerannual andrevenue anfrom actselling or practicesharing that is for another purpose, that clearly states the specificpersonal categoriesinformation of personalconsumers; data that the controller intends to collect, process, or transfer under each act or practice, and that uses easy-to-understand language with prominent headings that enable a reasonable consumer to identify and understand each act or practice;

(iii)or clearly(B) explaincontrols theor consumer'sis rightscontrolled relatedby toa consent;business that meets a threshold in (A) of this paragraph and shares a name, service mark, trademark, or other form of common branding with the business;

(iv)in makethis thesubparagraph, request"control" reasonablymeans accessible(i) ownership or the power to andvote usablemore bythan consumers50 withpercent disabilities;of the outstanding shares of any class of voting security of a business;

(v)(ii) makecontrol, thein requestany availablemanner, toof the consumerelection inof eacha languagemajority inof which the controllerdirectors provides a product or serviceof forindividuals whichexercising authorizationsimilar isfunctions; sought;

andor (vi)(iii) ensure that the optionpower to refuseexercise toa givecontrolling consentinfluence isover atthe leastmajority asof prominent and takes the samedirectors or fewerof stepsindividuals asexercising thesimilar optionfunctions; to give consent;

(B)(5) does"business notpurpose" includemeans (i)a consentuse for an actoperational purpose or practiceother inferrednotified frompurpose, if the inactionuse ofis reasonably necessary and proportionate to achieving the consumeroperational purpose or theother consumer'snotified continuedpurpose usefor ofwhich apersonal serviceinformation was collected or productprocessed, providedor byis thea controller;compatible use;

CSHB(6) 367(JUD)"categories of personal information" includes a category of HB 367 -24- HB0367bHB0367a New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\H34-LS1485\N (ii)personal acceptanceinformation ofset generalout orin broad(24) terms of usethis orsection and a similarcategory document that contains descriptions of personal datainformation processingnot alongspecifically withenumerated; other unrelated information;

(iii)(7) hovering"collect" over,includes muting,buying, pausing,renting, gathering, obtaining, receiving, or closingaccessing personal information pertaining to a givenconsumer pieceby ofactively contentor onpassively receiving information from the Internet;consumer, by observing the consumer's behavior, or by any other means;

(iv)(8) an"commercial agreementpurpose" obtainedincludes throughmarketing, theadvertising, useand ofany other purpose that advances a false,person's fraudulent,commercial or materiallyeconomic misleadinginterests, statementexcept engaging in political speech, journalism, or representation;other speech that state or federal courts have recognized as noncommercial speech;

or(9) (v)"commissioner" anmeans agreement obtained through the usecommissioner of acommerce, darkcommunity, pattern;and economic development;

(3)(10) "authenticate""compatible meansuse" the use of reasonable means to(A) determineauditing thatrelated a request to exercise a rightcurrent grantedinteraction towith athe consumer underand AScounting 45.48.800the -advertisement 45.48.898impressions ismade beingto madeindividual by,visitors, orverifying onpositioning behalfand of,quality theof consumeradvertisement whoimpressions, isand entitledauditing tocompliance exercisewith thatthis rightparagraph, withother respectstandards, toand theother personalconcurrent data;transactions;

(4)(B) "biometricdetecting data"security (A)incidents, meansprotecting dataagainst generatedmalicious, bydeceptive, automaticfraudulent, measurementsor ofillegal anactivity, individual'sand fingerprint,prosecuting voiceprint,those retina,persons iris,responsible gait,for or other unique biological pattern or characteristic that canactivity; be used to identify a specific individual;

(B)(C) doesidentifying notand includeremoving (i)errors afrom digitalcomputer hardware or physicalsoftware photograph;that impair existing intended functionality;

(ii)(D) anthe audiocontextual customization of advertisements shown as part of the same interaction and other short-term transient use, if the personal information is not disclosed to a third party and is not used to build a profile about a consumer or videoalter recording;the experience of an individual consumer outside the current interaction;

(E) maintaining or (iii)servicing dataaccounts, generatedproviding fromcustomer aservice, digitalprocessing or physicalfulfilling photographorders orand antransactions, audioverifying customer information, processing payments, providing financing, providing advertising HB0367a -25- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N or videomarketing recording,services, unlessproviding theanalytical dataservices, isand generatedperforming toother identifyservices aon specificbehalf individual;of the business or service provider;

(5)(F) "collect"conducting meansinternal toresearch buy,for rent,technological gather,development obtain,and receive,demonstration; access, or otherwise acquire personal data by any means;