Bill Summary – FastDemocracy

****
68th Legislature 2023                                                                                               SB 384.1
                                                 SENATE BILL NO. 384
                                     INTRODUCED BY D. ZOLNIKOV, K. REGIER
  3
  A BILL FOR AN ACT ENTITLED: “AN ACT ESTABLISHING THE CONSUMER DATA PRIVACY ACT;
  PROVIDING DEFINITIONS; ESTABLISHING APPLICABILITY; PROVIDING FOR CONSUMER RIGHTS TO
  PERSONAL DATA; ESTABLISHING REQUIREMENTS AND LIMITATIONS FOR A CONTROLLER OF
  PERSONAL DATA; ESTABLISHING REQUIREMENTS AND LIMITATIONS FOR A PROCESSOR OF
  PERSONAL DATA; PROVIDING FOR DATA PROTECTION ASSESSMENTS; PROVIDING EXEMPTIONS
  AND COMPLIANCE REQUIREMENTS; PROVIDING FOR ENFORCEMENT; AND PROVIDING EFFECTIVE
  DATES.”
 11
  BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
 13
          NEW SECTION. Section 1.          Short title. [Sections 1 through 12] may be cited as the "Consumer Data
  Privacy Act".
 16
          NEW SECTION. Section 2.          Definitions. As used in [sections 1 through 12], unless the context
  clearly indicates otherwise, the following definitions apply:
          (1)      "Affiliate" means a legal entity that shares common branding with another legal entity or
  controls, is controlled by, or is under common control with another legal entity.
          (2)      "Authenticate" means to use reasonable methods to determine that a request to exercise any
  of the rights afforded under [section 5(1)(a) through (1)(e)] is being made by, or on behalf of, the consumer who
  is entitled to exercise these consumer rights with respect to the personal data at issue.
          (3)      (a) "Biometric data" means data generated by automatic measurements of an individual's
  biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological
  patterns or characteristics that are used to identify a specific individual.
          (b)      The term does not include:
          (i)      a digital or physical photograph;
                                                                -1-                       Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                              SB 384.1
            (ii)    an audio or video recording; or
            (iii)   any data generated from a digital or physical photograph or an audio or video recording, unless
  that data is generated to identify a specific individual.
            (4)     "Child" means an individual under 13 years of age.
            (5)     (a) "Consent" means a clear affirmative act signifying a consumer's freely given, specific,
  informed, and unambiguous agreement to allow the processing of personal data relating to the consumer. The
  term may include a written statement, a statement by electronic means, or any other unambiguous affirmative
  action.
            (b)     The term does not include:
            (i)     acceptance of a general or broad term of use or similar document that contains descriptions of
  personal data processing along with other unrelated information;
            (ii)    hovering over, muting, pausing, or closing a given piece of content; or
            (iii)   an agreement obtained using dark patterns.
            (6)     (a) "Consumer" means an individual who is a resident of this state.
            (b)     The term does not include an individual acting in a commercial or employment context or as an
  employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or
  government agency whose communications or transactions with the controller occur solely within the context of
  that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.
            (7)     "Control" or "controlled" means:
            (a)     ownership of or the power to vote more than 50% of the outstanding shares of any class of
  voting security of a company;
            (b)     control in any manner over the election of a majority of the directors or of individuals exercising
  similar functions; or
            (c)     the power to exercise controlling influence over the management of a company.
            (8)     "Controller" means an individual who or legal entity that, alone or jointly with others, determines
  the purpose and means of processing personal data.
            (9)     "Dark pattern" means a user interface designed or manipulated with the effect of substantially
  subverting or impairing user autonomy, decision-making, or choice.
                                                                   -2-                  Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                                 SB 384.1
           (10)     "Decisions that produce legal or similarly significant effects concerning the consumer" means
  decisions made by the controller that result in the provision or denial by the controller of financial or lending
  services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities,
  health care services, or access to necessities such as food and water.
           (11)     "Deidentified data" means data that cannot be used to reasonably infer information about or
  otherwise be linked to an identified or identifiable individual or a device linked to the individual if the controller
  that possesses the data:
           (a)      takes reasonable measures to ensure that the data cannot be associated with an individual;
           (b)      publicly commits to process the data in a deidentified fashion only and to not attempt to
  reidentify the data; and
           (c)      contractually obligates any recipients of the data to satisfy the criteria set forth in subsections
  (11)(a) and (11)(b).
           (12)     "Identified or identifiable individual" means an individual who can be readily identified, directly
  or indirectly, in particular by reference to an identifier such as a name, an identification number, specific
  geolocation data, or an online identifier.
           (13)     "Institution of higher education" means any individual who or school, board, association, limited
  liability company, or corporation that is licensed or accredited to offer one or more programs of higher learning
  leading to one or more degrees.
           (14)     "Nonprofit organization" means any organization that is exempt from taxation under section
  501(c)(3), 501(c)(4), 501(c)(6) or 501(c)(12) of the Internal Revenue Code of 1986 or any subsequent
  corresponding internal revenue code of the United States as amended from time to time.
           (15)     (a) "Personal data" means any information that is linked or reasonably linkable to an identified
  or identifiable individual.
           (b)      The term does not include deidentified data or publicly available information.
           (16)     (a) "Precise geolocation data" means information derived from technology, including but not
  limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly
  identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.
           (b)      The term does not include the content of communications or any data generated by or
                                                                 -3-                      Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                              SB 384.1
  connected to advanced utility metering infrastructure systems or equipment for use by a utility.
            (17)    "Process" or "processing" means any operation or set of operations performed, whether by
  manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage,
  disclosure, analysis, deletion, or modification of personal data.
            (18)    "Processor" means an individual who or legal entity that processes personal data on behalf of a
  controller.
            (19)    "Profiling" means any form of automated processing performed on personal data to evaluate,
  analyze, or predict personal aspects related to an identified or identifiable individual's economic situation,
  health, personal preferences, interests, reliability, behavior, location, or movements.
            (20)    "Protected health information" has the same meaning as provided in the privacy regulations of
  the federal Health Insurance Portability and Accountability Act of 1996.
            (21)    "Pseudonymous data" means personal data that cannot be attributed to a specific individual
  without the use of additional information, provided the additional information is kept separately and is subject to
  appropriate technical and organizational measures to ensure that the personal data is not attributed to an
  identified or identifiable individual.
            (22)    "Publicly available information" means information that:
            (a)     is lawfully made available through federal, state, or municipal government records or widely
  distributed media; and
            (b)     a controller has a reasonable basis to believe a consumer has lawfully made available to the
  public.
            (23)    (a) "Sale of personal data" means the exchange of personal data for monetary or other
  valuable consideration by the controller to a third party.
            (b)     The term does not include:
            (i)     the disclosure of personal data to a processor that processes the personal data on behalf of
  the controller;
            (ii)    the disclosure of personal data to a third party for the purposes of providing a product or
  service requested by the consumer;
            (iii)   the disclosure or transfer of personal data to an affiliate of the controller;
                                                                 -4-                       Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                               SB 384.1
           (iv)     the disclosure of personal data in which the consumer directs the controller to disclose the
  personal data or intentionally uses the controller to interact with a third party;
           (v)      the disclosure of personal data that the consumer:
           (A)      intentionally made available to the public via a channel of mass media; and
           (B)      did not restrict to a specific audience; or
           (vi)     the disclosure or transfer of personal data to a third party as an asset that is part of a merger,
  acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other
  transaction in which the third party assumes control of all or part of the controller's assets.
           (24)     "Sensitive data" means personal data that includes:
           (a)      data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or
  diagnosis, information about a person's sex life, sexual orientation, or citizenship or immigration status;
           (b)      the processing of genetic or biometric data for the purpose of uniquely identifying an individual;
           (c)      personal data collected from a known child; or
           (d)      precise geolocation data.
           (25)     (a) "Targeted advertising" means displaying advertisements to a consumer in which the
  advertisement is selected based on personal data obtained or inferred from that consumer's activities over time
  and across nonaffiliated internet websites or online applications to predict the consumer's preferences or
  interests.
           (b)      The term does not include:
           (i)      advertisements based on activities within a controller's own internet websites or online
  applications;
           (ii)     advertisements based on the context of a consumer's current search query or visit to an
  internet website or online application;
           (iii)    advertisements directed to a consumer in response to the consumer's request for information
  or feedback; or
           (iv)     processing personal data solely to measure or report advertising frequency, performance, or
  reach.
           (26)     "Third party" means an individual or legal entity, such as a public authority, agency, or body,
                                                                 -5-                        Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                              SB 384.1
  other than the consumer, controller, or processor or an affiliate of the controller or processor.
  2
          NEW SECTION. Section 3.          Applicability. The provisions of [sections 1 through 12] apply to persons
  that conduct business in this state or persons that produce products or services that are targeted to residents of
  this state and:
          (1)       control or process the personal data of not less than 100,000 consumers, excluding personal
  data controlled or processed solely for the purpose of completing a payment transaction; or
          (2)       control or process the personal data of not less than 25,000 consumers and derive more than
  25% of gross revenue from the sale of personal data.
 10
          NEW SECTION. Section 4.          Exemptions. (1) [Sections 1 through 12] do not apply to any:
          (a)       body, authority, board, bureau, commission, district, or agency of this state or any political
  subdivision of this state;
          (b)       nonprofit organization;
          (c)       institution of higher education;
          (d)       national securities association that is registered under 15 U.S.C. 78o-3 of the federal Securities
  Exchange Act of 1934, as amended;
          (e)       financial institution or data subject to Title V of the Financial Services Modernization Act of
  1999, 15 U.S.C. 6801, et seq.; or
          (f)       covered entity or business associate as defined in the privacy regulations of the federal Health
  Insurance Portability and Accountability Act of 1996, 45 CFR 160.103.
          (2)       Information and data exempt from [sections 1 through 12] include:
          (a)       protected health information under the privacy regulations of the federal Health Insurance
  Portability and Accountability Act of 1996;
          (b)       patient-identifying information for the purposes of 42 U.S.C. 290dd-2;
          (c)       identifiable private information for the purposes of the federal policy for the protection of human
  subjects of 1991, 45 CFR, part 46;
          (d)       identifiable private information that is otherwise information collected as part of human subjects
                                                                -6-                      Authorized Print Version – SB 384
****
68th Legislature 2023                                                                                             SB 384.1
  research pursuant to the good clinical practice guidelines issued by the international council for harmonisation
  of technical requirements for pharmaceuticals for human use;
           (e)     the protection of human subjects under 21 CFR, parts 6, 50, and 56, or personal data used or
  shared in research as defined in the federal Health Insurance Portability and Accountability Act of 1996, 45
  CFR 164.501, that is conducted in accordance with the standards set forth in this subsection (2)(e), or other
  research conducted in accordance with applicable law;
           (f)     information and documents created for the purposes of the Health Care Quality Improvement
  Act of 1986, 42 U.S.C. 11101, et seq.;
           (g)     patient safety work products for the purposes of the Patient Safety and Quality Improvement
  Act of 2005, 42 U.S.C. 299b-21, et seq., as amended;
           (h)     information derived from any of the health care-related information listed in this subsection (2)
  that is deidentified in accordance with the requirements for deidentification pursuant to the privacy regulations
  of the federal Health Insurance Portability and Accountability Act of 1996;
           (i)     information originating from and intermingled to be indistinguishable with or information treated
  in the same manner as information exempt under this subsection (2) that is maintained by a covered entity or
  business associate as defined in the privacy regulations of the federal Health Insurance Portability and
  Accountability Act of 1996, 45 CFR 160.103, or a program or qualified service organization, as specified in 42
  U.S.C. 290dd-2, as amended;
           (j)     information used for public health activities and purposes as authorized by the federal Health
  Insurance Portability and Accountability Act of 1996, community health activities, and population health
  activities;
           (k)     the collection, maintenance, disclosure, sale, communication, or use of any personal
  information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general
  reputation, personal characteristics, or mode of living by a consumer reporting agency, furnisher, or user that
  provides information for use in a consumer report and by a user of a consumer report, but only to the extent
  that the activity is regulated by and authorized un