→
Previous
Latest
FILED SENATE GENERAL ASSEMBLY OF NORTH CAROLINA Mar 25, 2025 S.B.
GENERAL ASSEMBLY OF NORTH CAROLINA SESSION 2025 S 1 SENATE BILL 757 Short Title:
757 SESSION 2025 PRINCIPAL CLERK S D SENATE BILL DRS35255-LR-105A Short Title:
A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.
Rules and Operations of the Senate March 26, 2025 A BILL TO BE ENTITLED AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT OF NORTH CAROLINA.
75F-4 is made by the consumer who is entitled to exercise those rights.
75F-4 is made bythe consumer who is entitled to exercise those rights.
*DRS35255-LR-105A* General Assembly Of North Carolina Session 2025 e.
*S757-v-1* General Assembly Of North Carolina Session 2025 e.
– An affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.
– An affirmative act bya consumer that unambiguouslyindicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer.
Page 2 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 c.
Page 2 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 c.
– An individual who can be readily identified, directly or indirectly.
– An individual who can be readilyidentified, directly or indirectly.
(29) Publiclyavailableinformation.– Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonably believes a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.
(29) Publiclyavailableinformation.
–Informationthataperson(i)lawfullyobtains from a record of a governmental entity, (ii) reasonablybelieves a consumer or widely distributed media has lawfully made available to the general public, or (iii) if the consumer has not restricted the information to a specific audience, obtains from a person to whom the consumer disclosed the information.
– The exchange of personal data for monetary consideration by the controller to a third party.
– The exchange of personal data for monetaryconsideration by the controller to a third party.
Considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a DRS35255-LR-105A Page 3 General Assembly Of North Carolina Session 2025 third party if the purpose is consistent with a consumer's reasonable expectations.
Considering the context in which the consumer provided the personal data to the controller, a controller's disclosure of personal data to a Senate Bill 757-First Edition Page 3 General Assembly Of North Carolina Session 2025 third party if the purpose is consistent with a consumer's reasonable expectations.
Page 4 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (35) Third party.
Page 4 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (35) Third party.
Information and documents created for purposes of the federal Health CareQuality Improvement Act of1986,42U.S.C.
Information and documents created for purposes of the federal Health CareQualityImprovement Act of1986,42U.S.C.
and DRS35255-LR-105A Page 5 General Assembly Of North Carolina Session 2025 2.
and Senate Bill 757-First Edition Page 5 General Assembly Of North Carolina Session 2025 2.
(8) Information originating from, and intermingled to be indistinguishable with, information under subdivision (7) of this subsection that is maintained by a (i) healthcarefacilityorhealthcareprovideror(ii)programoraqualifiedservice organization as defined in 42 C.F.R.
(8) Information originating from, and intermingled to be indistinguishable with, information under subdivision (7) of this subsection that is maintained bya (i) healthcarefacilityorhealthcareprovideror(ii)programoraqualifiedservice organization as defined in 42 C.F.R.
Aconsumer reporting agency,as definedin 15 U.S.C.
Aconsumer reportingagency,as definedin 15 U.S.C.
In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party to the extent the collection and use of the data are related to the individual's role;
In the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third partyto the extent the collection and use of the data are related to the individual's role;
(c) A controller is in compliance with any obligation to obtain parental consent under this Chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C.
(c) A controller is in compliance with anyobligation to obtain parental consent under this Chapter if the controller complies with the verifiable parental consent mechanisms under the Children's Online Privacy Protection Act, 15 U.S.C.
Page 6 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (d) This Chapter does not require a person to take any action in conflict with the federal Health InsurancePortabilityandAccountabilityActof1996,42U.S.C.
Page 6 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (d) This Chapter does not require a person to take any action in conflict with the federal Health InsurancePortabilityandAccountabilityActof1996,42U.S.C.
If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall (i) inform the consumer of the extension, including the length of the extension, and (ii) provide the reasons the extension is reasonably necessary.
If a controller extends the initial 45-dayperiod, before the initial 45-dayperiod expires, the controller shall (i) inform the consumer of the extension, including the length of the extension, and (ii) provide the reasons the extension is reasonably necessary.
(d) The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.
(d) The 45-dayperiod does not applyif the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.
However,acontrollermay charge areasonablefee to covertheadministrativecosts ofcomplying with a request or refuse to act on a request if:
However,acontrollermaycharge areasonablefee to covertheadministrativecosts ofcomplying with a request or refuse to act on a request if:
DRS35255-LR-105A Page 7 General Assembly Of North Carolina Session 2025 (1) The request is excessive, repetitive, technically infeasible, or manifestly unfounded;
Senate Bill 757-First Edition Page 7 General Assembly Of North Carolina Session 2025 (1) The request is excessive, repetitive, technically infeasible, or manifestly unfounded;
(b) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical datasecurity practices designedto protect theconfidentiality and integrity of personal data and reduce reasonably foreseeable risks of harm to consumers relating to the Page 8 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 processing of personal data.
(b) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical datasecuritypractices designed to protect theconfidentialityand integrity of personal data and reduce reasonably foreseeable risks of harm to consumers relating to the Page 8 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 processing of personal data.
Nothing in this subsection prohibits a controller from offering a different price, rate, level, quality, orselection ofagood orserviceto aconsumer,including offeringagoodorservice for no fee or at a discount, if the consumer has opted out of targeted advertising or the offer is related to the consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
Nothing in this subsection prohibits a controller from offering a different price, rate, level, quality, orselection ofagood orserviceto aconsumer,includingofferinga goodorservice for no fee or at a discount, if the consumer has opted out of targeted advertising or the offer is related to the consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.
75F-4(a)(1)through (a)(3)donotapplytopseudonymous data if a controller demonstrates that any information necessary to identify a consumer is kept separately and subject to appropriate technical and organizational measures to ensure the personal data are not attributed to an identified individual or an identifiable individual.
75F-4(a)(1)through(a)(3)donotapplytopseudonymous data if a controller demonstrates that any information necessary to identify a consumer is kept separately and subject to appropriate technical and organizational measures to ensure the personal data are not attributed to an identified individual or an identifiable individual.
DRS35255-LR-105A Page 9 General Assembly Of North Carolina Session 2025 (a) The requirements described in this Chapter do not restrict a controller's or processor's ability to do any of the following:
Senate Bill 757-First Edition Page 9 General Assembly Of North Carolina Session 2025 (a) The requirements described in this Chapter do not restrict a controller's or processor's ability to do any of the following:
(8) Detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity orinvestigate,report,orprosecuteapersonresponsibleforanactiondescribed in this subdivision.
(8) Detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or anyillegal activity orinvestigate,report,orprosecuteapersonresponsibleforanactiondescribed in this subdivision.
Page 10 DRS35255-LR-105A General Assembly Of North Carolina Session 2025 (c) A controller or processor is not in violation of this Chapter if:
Page 10 Senate Bill 757-First Edition General Assembly Of North Carolina Session 2025 (c) A controller or processor is not in violation of this Chapter if:
(1) Writtennoticeidentifyingeach provision ofthis Chapterthe Attorney General alleges the controller or processor has violated or is violating.
(1) Writtennoticeidentifyingeach provision ofthis Chapterthe AttorneyGeneral alleges the controller or processor has violated or is violating.
(g) If more than one controller or processor are involved in the same processing in violation of this Chapter, the liability for the violation shall be allocated among the controllers or processors in proportion to the comparative fault of each controller or processor.
(g) If more than one controller or processor are involved in the same processing in violation of this Chapter, the liabilityfor the violation shall be allocated among the controllers or processors in proportion to the comparative fault of each controller or processor.
(a) There is created a restricted account known as the "Consumer Privacy Account." The account shall be funded by money received through civil enforcement actions under this Chapter.
(a) There is created a restricted account known as the "Consumer Privacy Account." The account shall be funded bymoneyreceived through civil enforcement actions under this Chapter.
DRS35255-LR-105A Page 11 General Assembly Of North Carolina Session 2025 (b) Upon appropriation by the General Assembly, the account funds may be used by the Attorney General for these purposes:
Senate Bill 757-First Edition Page 11 General Assembly Of North Carolina Session 2025 (b) Upon appropriation by the General Assembly, the account funds may be used by the Attorney General for these purposes:
(a) The Attorney General and the Division shall compile a report evaluating the liability and enforcement provisions of this Chapter, including the effectiveness of the Attorney General's and the Division's efforts to enforce this Chapter and summarizing the data protected and not protected by this Chapter, including, with reasonable detail, a list of the types of information that are publicly available from State, local, and federal government sources.
(a) The Attorney General and the Division shall compile a report evaluating the liability and enforcement provisions of this Chapter, includingthe effectiveness of the AttorneyGeneral's and the Division's efforts to enforce this Chapter and summarizing the data protected and not protected bythis Chapter, including, with reasonable detail, a list of the types of information that are publicly available from State, local, and federal government sources.
Page 12 DRS35255-LR-105A
Page 12 Senate Bill 757-First Edition
⬇ Download PDF