HB 262 — AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO DATA BROKERS AND CONSUMER PROTECTION.

262(4)a. by inserting the following after line 75 and before line 76 and redesignating accordingly:

"(9)“Data "Publiclybroker” available information" means brokereda personalbusiness information that isboth lawfully(i) madeknowingly readilymaintains availableor tocollects the generalbrokered publicpersonal byinformation aof governmentalat entityleast 500 consumers and (ii) either sells or fromlicenses widelysuch distributedinformation media."to FURTHERone AMENDor Housemore Billindependently No.operated businesses.

262The byterm inserting“data afterbroker” lineincludes, 77but andis beforenot linelimited 78to, data collectors and redesignatingthird-party accordingly:data brokers.

“(11)A “Sell”business meansmay tobe transferboth brokereda personaldata informationcollector fromand a businessthird-party todata abroker thirddepending partyon inits exchangeactivities. for monetary consideration.” FURTHER AMEND House Bill No.

262b. by inserting the following after line 77 and before line 78 and redesignating accordingly:

"(12)“Data "Third-partycollector” service provider" means a vendordata orbroker other person that providesinitially acollects servicepersonal to a data marketfrom participantone pursuantor tomore aconsumers contract,through and includes a businesstransaction thator providesobservation. re-insurance services to an insurance company and a "business associate" as defined in the Health Insurance Portability and Accountability Act of 1996 (P.L.

104-191,b. as amended)." FURTHER AMEND House Bill No.

262“Third-party bydata deletingbroker” “shallmeans not”a asdata itbroker appearsthat onreceives linesthe 79,brokered 82,personal 86,information andof 89,one andor substitutingmore consumers with whom the data broker does not have a direct relationship (e.g., employee, contractor, agent, investor, donor, customer, client, subscriber, user, or other similar relationship in lieuwhich thereofthe “mayconsumer not”.would be aware that the data broker received the consumer’s personal information directly from the consumer).

FURTHERc. AMEND House Bill No.

262The onfollowing lineactivities 80conducted by deletinga "databusiness, collector’s"and wherethe itcollection appearsand thereinsale andor insertinglicensing inof lieubrokered thereofpersonal "person’s".information incidental to conducting these activities, do not qualify the business as a data broker:

FURTHER1. AMEND House Bill No.

262Providing on411 linesdirectory 87assistance or directory information services, including name, address, and 90telephone bynumber, deletingon “orbehalf reasonablyof shouldor know”as wherea itfunction appearsof therein.a telecommunications carrier;

FURTHER2. AMEND House Bill No.

262Providing onpublicly lineavailable 92information byrelated deletingto "A"a afterconsumer's "(e)"business andor beforeprofession; "violation" and inserting in lieu thereof "Notwithstanding anything in § 2513(b)(3) of this title to the contrary, a".

FURTHERor AMEND3. House Bill No.

262Providing onpublicly lineavailable 94information byvia deletingreal-time "dataor brokers"near-real-time wherealert itservices appearsfor thereinhealth andor insertingsafety inpurposes; lieu thereof "data market participants".

FURTHERor AMEND4. House Bill No.

262Providing onbrokered linepersonal 108information byof deletingan "2022"individual whereto itan appearsemployer, thereinpotential andemployer, insertinggovernment agency, or contractual counterparty of the individual, with the written authorization of such individual in lieuconnection thereofwith "2023".a background check of such individual.

5.

Providing brokered personal information where authorized by 21 Del.

C.

§305.

d.

The phrase “sells or licenses” does not include:

MAW Page 2 of 610 Released:

03/30/202206/30/2021 02:5310:52 PMAM FURTHER1. AMEND House Bill No.

262A onone-time lineor 110occasional bysale deletingof "2021"assets whereof ita appearsbusiness thereinas andpart insertingof ina lieutransfer thereofof "2022".control of those assets that is not part of the ordinary conduct of the business;

FURTHERor AMEND2. House Bill No.

262A onlicense linesof 116,data 136,that 188,is 190,both andincidental 193to bya deletingcontract "it"the wherebusiness ithas appearswith thereina third-party service provider and insertingnecessary infor lieusuch thereofthird-party "theservice provider of the business to accomplish the purpose of such contract, provided that the third-party service provider’s permitted uses of the licensed data marketis participant".limited to fulfilling its contractual obligations to the business;

FURTHERor AMEND3. House Bill No.

262The ondisclosure linesor 118,transfer 119,of 131,brokered 212,personal 217,information 218,pursuant andto 224the byterms deletingof "dataa broker’s"subpoena, wherea itcourt appearsorder, thereina andregulation, insertinga instatute, lieua thereofresponse "datato marketa participant’s".discovery request, or other legal obligation.

FURTHER(5)a. AMEND House Bill No.

262“Data bybroker deletingsecurity linesbreach” 139means, throughwith 179respect into theirbrokered entiretypersonal andinformation, substitutinga “breach of security” as set forth in lieu§ thereof12B-101(1) theof following:Chapter 12B of this title.

“g.b.

AnswersIn indetermining thewhether providedbrokered formpersonal information was acquired or is reasonably believed to eachhave ofbeen accessed or obtained by a person without valid authorization, a data broker shall consider all relevant factors, including but not limited to the following exemplarfactors: questions:

Indications that the brokered personal information is in the physical possession and control of a person without valid authorization, such as a lost or stolen computer or other device containing brokered personal information;

2.

Indications that the brokered personal information was accessed, downloaded, or copied;

3.

Indications that an unauthorized person used the brokered personal information, such as the opening of fraudulent accounts or reports of identity theft;

and 4.

Indications that the brokered personal information has been made public.

(6) “Encryption” means the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without use of a confidential process or key.

(7) “License” means a grant of access to, or distribution of, data by one person to another in exchange for consideration.

A license does not include use of data for the sole benefit of the data provider if the data provider maintains control over the use of the data.

(8) “Record” means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.

§ 12D-102.

Prohibitions on the acquisition and dissemination of brokered personal information.

HD :

MS :

MAW Page 3 of 10 Released:

06/30/2021 10:52 AM 79 (a) A person shall not acquire brokered personal information through deception, false representations, or other fraudulent means, including on the basis of misrepresentations or material omissions about the data collector’s use of the brokered personal information.

(b) A person shall not acquire or use brokered personal information for the purpose of any of the following:

(1) Stalking or harassing another person.

(2) Committing a fraud, including identity theft, financial fraud, or e-mail fraud.

(3) Engaging in unlawful discrimination, including employment discrimination and housing discrimination.

(c) A data broker shall not provide for consideration, whether by sale, license, or other exchange, to another person brokered personal information where that data broker knows or reasonably should know that such brokered personal information was acquired in a manner prohibited by §12D-102(a), above.

(d) A data broker shall not provide for consideration, whether by sale, license, or other exchange, to another person brokered personal information where that data broker knows or reasonably should know that such brokered personal information will be used for any of the purposes set forth in §12D-102(b), above.

(e) A violation of subsections (a), (b), (c), or (d) of this section shall be deemed an unlawful practice under § 2513 of this title and a violation of subchapter II of Chapter 25 of this title.

§ 12D-103.

Annual registration of data brokers.

(a) Annually, on or before January 31 following a year in which a person meets the definition of data broker as provided in § 12D-101 of this title, a data broker shall do all of the following:

(1) Register with the Consumer Protection Unit of the Department of Justice.

(2) Pay a registration fee calculated based on the activity of the data broker in the year immediately preceding the date of registration, as follows:

a.

For a data broker who sold or licensed the brokered personal information of not more than 5,000 consumers and engaged in not more than 5 such sale or license transactions during the relevant year, the registration fee is $10.

b.

For a data broker who is not eligible for the fee under sub-paragraph (a)(2)a., above, and who sold or licensed the brokered personal information of not more than 200,000 consumers, the registration fee is equal to the multiple of the number of consumers times $0.0025, rounded up to the nearest $10.

c.

For a data broker who sold or licensed the brokered personal information of more than 200,000 consumers, the registration fee is $500.

HD :

MS :

MAW Page 4 of 10 Released:

06/30/2021 10:52 AM d.

For registration fees due in each year after 2022, the calculations in paragraph (a)(2) of this section shall be increased by multiplying the registration fee calculated pursuant to paragraphs (a)(2)b.

and (a)(2)c.

of this section by the cumulative change in the national consumer price index from January 1, 2021 to January 1 in the year in which the registration fee is due.

The registration fee due pursuant to paragraph (a)(2)a.

is not subject to such increase.

(3) In an electronic form designated by the Director of Consumer Protection, provide all of the following information, accompanied by a certification of the accuracy of such information:

a.

The name and primary physical, e-mail, and Internet addresses of the data broker and links to all privacy policies issued by the data broker that are applicable to the brokered personal information that it collects or maintains.

b.

If the data broker permits a consumer to opt out of the data broker's collection of brokered personal information, opt out of the inclusion, use, or processing of the consumer’s information in the data broker’s databases, or opt out of certain sales of data about the consumer:

1.

The method for requesting an opt-out, including, as applicable, each of the following:

A.

a direct weblink to an opt-out form.

B.

an email address to which opt out requests can be made C.

a phone number to which opt-out requests can be made D.

a physical address to which opt-out requests can be emailed.

2.

If the opt-out applies to only certain activities or sales, which ones.

3.

Whether the data broker permits a consumer to authorize a third party to perform the opt-out on the consumer's behalf.

c.

A statement specifying the data collection, databases, or sales activities from which the data broker does not offer the consumer any ability to opt out.

d.

A description of the data broker’s process for verifying the purchasers of its brokered personal information, along with such purchasers’ compliance with relevant privacy policies and representations, including any purchaser credentialing process.

e.

The number of data broker security breaches that the data broker has experienced during the prior 3 years, and if known, the total number of consumers affected by the breaches.

HD :

MS :

MAW Page 5 of 10 Released:

06/30/2021 10:52 AM f.

Where the data broker has actual knowledge that it possesses the brokered personal information of minors, a separate statement detailing the data collection practices, databases, sales activities, and opt-out policies that are applicable to the brokered personal information of minors.

g.

Answers in the provided form to each of the following questions:

Are you a data collector,collector? meaning that you initially collect consumer data directly from consumers? Answer Choices:

2.

Are you a third-party data broker,broker? meaning that you receive data about consumers with whom you do not have a direct relationship (e.g., employee, contractor, agent, investor, donor, customer, client, subscriber, user, or other similar relationship in which the consumer would be aware that you receive the consumer’s personal information directly from the consumer)? Answer Choices:

3.

Identify the six-digit NAICS (North American Industry Classification System) Code for your business.business:

4.Answer Choice:

[6-digit Numeric Response] Question:

(17) other.other Question:

5.Which of the following categories of consumer data do you purchase or license from other data brokers? Answer Choices [SAME] Question:

Which of the following categories of consumer data do you sell or license to other third parties? Answer Choices [SAME] Question:

Which of the following categories of consumer data, listed in question 4, do you purchase or license from other data market participants? 6.

Question:

Which of the following categories of consumer data, listed in question 4, do you sell or license to other third parties? HD :

MS :

MAW Page 3 of 6 Released:

03/30/2022 02:53 PM 84 7.

Question:

8.

(2) Yes,HD we: contractually limit use to those purposes set forth in our contract;

MS :

MAW Page 6 of 10 Released:

06/30/2021 10:52 AM Yes, we contractually limit use to those purposes set forth in our contract;

9.

10.

How many complaints or reports have you received about the use, sale, licensing, or other disclosure of consumers brokered personal information in a manner incompatible with its collection? 11.Question:

Have you received any reports from persons to whom you sold or licensed brokered personal information of any violation of the terms of such sale or license? Question:

Have you receivedterminated anythe reportssale fromor personslicense toof whomany youbrokered soldpersonal orinformation licensedbased brokeredin personalwhole informationor ofin part on any violation of the terms of such sale or license? 12.Question:

Question:

Have you terminated the sale or license of any brokered personal information based in whole or in part on any violation of the terms of such sale or license? 13.

Question:

(2) No.” FURTHER AMEND House Bill No.

262h. by inserting the following after line 192 and before line 193 and redesignating accordingly:

"(c)On Aan businessannual thatbasis doesby notSeptember sell1 orin licensethe brokeredyear personalpreceding informationthe doesyear notin havewhich toa registerregistration underis thisdue, section."the FURTHERDirector AMENDof HouseConsumer BillProtection No.may add and remove questions and answer choices to the questions set forth in paragraph (a)(3)g.

262of onthis linesection 204as bythe insertingDirector "onedetermines or"to afterbe "in"appropriate andin beforelight "more"of therein.the evolving nature of the data brokerage industry.

i.

Any additional information or explanation the data broker chooses to provide concerning its data collection practices.

(b) A data broker that fails to register pursuant to subsection (a) of this section is liable to the State for all of the following:

(1) A civil penalty of $50 for each day, not to exceed a total of $10,000 for each year, it fails to register pursuant to this section;

(2) An amount equal to the fees due under this section during the period it failed to register pursuant to this section;

and (3) Other penalties imposed by law.

(c) A data broker that includes information it knows or reasonably should know to be false in a registration submitted pursuant to subsection (a) of this section is liable to the State for all of the following:

MAW Page 47 of 610 Released:

03/30/202206/30/2021 02:5310:52 PMAM FURTHER(1) AMENDA Housecivil Billpenalty No.of $50 for each day, not to exceed a total of $10,000 for each year, its registration included such false information;

262(2) onAn lineamount 223equal byto deletingthe "state"fees wheredue itunder appearsthis thereinsection andduring insertingthe period its registration included such false information, which shall be in lieuaddition thereofto "State".any fees already paid;

FURTHERand AMEND(3) HouseOther Billpenalties No.imposed by law.

262(d) onNothing linein 224this bysection insertingshall "includinglimit the Healthapplicability Insuranceof Portabilityother andconsumer Accountabilityprotection Actlaws to the conduct of 1996a (P.L.data broker.

104-191,§ as12D-104. amended), the Gramm Leach Bliley Act (15 U.S.C.

§Data 6801,broker etduty seq.,to asprotect amended),personal theinformation. Fair Credit Reporting Act (15 U.S.C.

§(a) 1681,A etdata seq.,broker asshall amended),develop, implement, and themaintain Delawarea Insurancecomprehensive Datainformation Securitysecurity Actprogram (Chapterthat 86is ofwritten Titlein 18),"more afterreadily "brokeredaccessible personalparts information,"and contains administrative, technical, and beforephysical "and"safeguards therein.that are reasonably designed to achieve the following objectives:

FURTHER(1) AMENDEnsuring Housethe Billsecurity No.and confidentiality of brokered personal information.

262(2) onProtecting linesagainst 224any andanticipated 225threats byor insertinghazards "requiredto bythe thissecurity section"or afterintegrity "program"of brokered personal information, including internal and beforeexternal "conforms"threats therein.or hazards.

FURTHER(3) AMENDProtecting Houseagainst Billthe No.unauthorized acquisition of, or access to, brokered personal information.

262(b) onIn linedetermining 225whether a comprehensive information security program required by insertingthis "orsection State"is afterreasonably "federal"designed, andthe beforefollowing "law"factors therein.shall be considered:

FURTHER(1) AMENDThe Housesize, Billscope, No.and type of the data broker’s business.

262(2) byThe deletingamount linesof 226resources andavailable 227to inthe theirdata entiretybroker andrelative insertingto inthe lieucost thereofto the following:data broker to implement and maintain the security procedures.

"(d)(3) PursuantThe toamount the enforcement duties and powers of thebrokered Directorpersonal ofinformation Consumermaintained Protectionby of the Departmentdata ofbroker. Justice under Chapter 25 of Title 29, the Attorney General may bring an action in law or equity to address the violations of this section and for other relief that may be appropriate to ensure proper compliance with this section or to recover direct economic damages resulting from a violation, or both.

(4) The provisionssensitivity of thisthe sectionbrokered arepersonal notinformation exclusive and do not relieve a person subject to thisbe sectionprotected. from compliance with all other applicable provisions of law.

(e)(5) NothingThe indata thisbroker’s sectioninformation issecurity intendedprogram toand modifypractices anyas right which a personwhole. may have at common law, by statute, or otherwise." FURTHER AMEND House Bill No.

262(c) onA linedata 228broker’s bycomprehensive deletinginformation "Datasecurity Brokerprogram Fund"shall wherebe itdeemed appearsto thereinbe andreasonably insertingdesigned infor lieupurposes thereofof "Privacysubsection Protection(a) Fund.".of this section if any of the following are true:

FURTHER(1) AMENDThe Houseprogram Billconforms No.to the standards or framework of a nationally- or internationally-recognized standards-setting organization in the field of cybersecurity, to be identified by the Director of Consumer Protection through rulemaking pursuant to subsection (a) of § 12D-106 of this chapter.

262 on line 229 by deleting "Internet" where it appears therein.

SYNOPSIS This amendment makes the following changes to the Act following meetings and discussions with stakeholders and consideration of the Act in committee:

The amendment clarifies the definitions of "brokered personal information" and “business”.

The amendment changes the term "data broker" to "data market participant" throughout the Act.The amendment excludes from the definition of “data market participant” any entity to the extent that it is a financial institution or an affiliate of a financial institution subject to the federal Gramm Leach Bliley Act.

The amendment relocates the definitions of "data collector" and "third-party data broker" within the Act.

The amendment adds definitions for the terms "Consumer Protection Unit", "publicly available information", “sell”, and "third-party service provider" used in the Act.

The amendment limits the liability of data market participants, for certain conduct of third parties, to the data market participant’s actual knowledge.

The amendment clarifies that the Consumer Protection Unit of the Department of Justice has enforcement authority over all violations of subsections (a), (b), and (c) of Section 12D-102.

MAW Page 58 of 610 Released:

03/30/202206/30/2021 02:5310:52 PMAM (2) The amendmentdata clarifiesbroker thatis asubject businessto whichthe doesrequirements notof sellany federal or licensestate law or regulation governing the protection, security, or integrity of brokered personal information, and the data broker’s information doessecurity notprogram haveconforms to registerthe underrequirements of the Act.applicable federal law or regulation.

The(d) amendmentA providesviolation examples of federalthis andsection Stateshall lawsbe ordeemed regulationsan governingunlawful thepractice protection,under security,§ or2513 integrity of brokeredthis personaltitle informationand that may provide a safeviolation harborof forsubchapter aII dataof marketChapter participant's25 writtenof informationthis securitytitle. program.

The§ amendment12D-105. eliminates the private right of action for violations of Section 12D-104.

TheData amendmentBroker changesFund the(a) nameThere ofshall thebe a fund to be establishedknown as the Internet Privacy Protection Fund, which shall be credited by the Act.State Treasurer with all of the following:

The(1) amendmentAll alsofees makesreceived technicalpursuant corrections to the§ Act12D-103 andof conformsthis thechapter. language to the Delaware Legislative Drafting Manual.

(2) All funds received by the Department of Justice for any activity by the Consumer Protection Unit of the Department of Justice to enforce the provisions of this chapter.

(b) Money in the Internet Privacy Protection Fund may be used for expenses incurred by the Consumer Protection Unit of the Department of Justice in connection with any activity to carry out or enforce the provisions of this chapter, including payment of salaries for personnel and costs, expenses incurred in administering the registration process set forth in § 12D-103 of this chapter, charges incurred in the preparation, institution, and maintenance of investigations or enforcement actions brought pursuant to the authority granted by this chapter, and consumer education and outreach relating to information security and privacy.

§ 12D-106.

Regulations, Guidance, and Public Information.

(a) The Director of Consumer Protection shall promulgate regulations to carry out the purposes of this chapter, which shall include identifying acceptable information security standards or frameworks for purposes of the safe harbor provision of paragraph (c)(1) of § 12D-104 of this chapter, which may include:

(1) The National Institutes of Standards and Technology (NIST).

(2) The Federal Risk and Authorization Management Program.

(3) The Center for Internet Security.

(4) The Joint Technical Committee of the International Organization for Standardization and the International Electrotechnical Commission.

(b) The Consumer Protection Unit of the Department of Justice shall make public on a searchable website the information each data broker submits pursuant to paragraph (a)(3) of § 12D-103 of this chapter.

The Consumer Protection Unit of the Department of Justice shall update the website with the current year’s registration information by April 30 of HD :

MS :

MAW Page 9 of 10 Released:

06/30/2021 10:52 AM each year.

The Director of Consumer Protection may aggregate and analyze data broker registration information and make the results of any such analysis public.

SYNOPSIS This Act seeks to provide consumers with critical information about how their personal information is being used by data brokers.

This Act requires data brokers to register with the Consumer Protection Unit of the Department of Justice and answer questions regarding their use of personal information that would be published online to inform consumers.

A fee schedule is established based on the size of the data broker that would fund the enforcement of the statute.

Entities or individuals who collect personal information but do not sell or license that personal data are not required to register.

Registration only applies to data brokers who sell or license information.

The Act prohibits acquiring or providing brokered personal information where it will be used for certain unlawful purposes, or where it was obtained through fraudulent means.

The Act requires data brokers to protect brokered personal information.

MAW Page 610 of 610 Released:

03/30/202206/30/2021 02:5310:52 PMAM 21415105942141510376