Bill Summary – FastDemocracy

Unofficial Draft Copy
****                                                 As of: 11/01/2024, 02:50:50
69th Legislature 2025                                Drafter: Joseph Carroll, ****                                 LC 0722
                                                     **** BILL NO. ****
                                                  INTRODUCED BY ****
  3
  A BILL FOR AN ACT ENTITLED: “AN ACT ***; PROVIDING DEFINITIONS; AMENDING SECTIONS 30-14-
  2802, 30-14-2803, 30-14-2804, 30-14-2808, 30-14-2809, 30-14-2812, 30-14-2813, 30-14-2814, 30-14-2815,
  30-14-2816, AND 30-14-2817, MCA.”
  7
  BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
  9
          NEW SECTION. Section 1.         Short title. [Sections XX through XX] may be cited as the "Electronic
  Data Ownership Act".
 12
          NEW SECTION. Section 2.         Definitions. As used in [***], unless the context clearly indicates
  otherwise, the following definitions apply:
          (1)      "electronic data" means [***]
          (2)      "individual" means [***]
          (3)      "person" means
 18
          NEW SECTION. Section 3.         Electronic data ownership. (1) Electronic data created by or on behalf
  of an individual who is a resident of Montana is the property of that individual.
          (2)      A person possessing electronic data owned by an individual holds the property in trust for the
  individual.
 23
          NEW SECTION. Section 4.         Death of owner of electronic data. (1) Electronic data ownership is
  non-descendible.
          (2)      A person possessing electronic data owned by a deceased individual shall permanently delete
  the electronic data within a reasonable time of the final distribution of assets through testate or intestate
                                                                 -1-                                                   LC 722
                                                    Unofficial Draft Copy
****                                               As of: 11/01/2024, 02:50:50
69th Legislature 2025                              Drafter: Joseph Carroll, ****                                     LC 0722
  succession.
  2
          NEW SECTION. Section 5.         Prohibited terms in contracts of adhesion. (1) A contract of adhesion
  may not require a resident of Montana to forfeit, donate, or accept nominal consideration for electronic data.
          (2)      A contract of adhesion may not condition the use of a product or service on the forfeiture,
  donation, or acceptance of nominal consideration for electronic data.
  7
          NEW SECTION. Section 6.         Consideration for sale of electronic data. A seller of electronic data
  must provide to the owner of the electronic data:
          (1)      actual consideration that is reasonably related to the value of the electronic data.
          (2)      identifying information of the purchaser of the electronic data.
 12
          NEW SECTION. Section 7.         Causes of action. (1) An individual whose electronic data is sold in
  violation of [this act] has a private cause of action against the person that sold the electronic data.
          (2)      The attorney general or a county attorney may apply for an injunction or commence a civil
  action against any person to compel compliance with the terms of [this act], and may seek punitive damages
  and reasonable attorney fees.
 18
          Section 8. Section 30-14-2802, MCA, is amended to read:
          "30-14-2802.     Definitions. As used in this part, unless the context clearly indicates otherwise, the
  following definitions apply:
          (1) "Affiliate" means a legal entity that shares common branding with another legal entity or controls, is
  controlled by, or is under common control with another legal entity.
          (2) "Authenticate" means to use reasonable methods to determine that a request to exercise any of the
  rights afforded under 30-14-2808(1)(a) through (1)(e) is being made by, or on behalf of, the consumer who is
  entitled to exercise these consumer rights with respect to the personal data at issue.
          (3) (a) "Biometric data" means data generated by automatic measurements of an individual's biological
  characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or
                                                                -2-                                                   LC 722
                                                      Unofficial Draft Copy
****                                                As of: 11/01/2024, 02:50:50
69th Legislature 2025                               Drafter: Joseph Carroll, ****                                 LC 0722
  characteristics that are used to identify a specific individual.
          (b) The term does not include:
          (i) a digital or physical photograph;
          (ii) an audio or video recording; or
          (iii) any data generated from a digital or physical photograph or an audio or video recording, unless that
  data is generated to identify a specific individual.
          (4) "Child" means an individual under 13 years of age.
          (5) (a) "Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed,
  and unambiguous agreement to allow the processing of personal data relating to the consumer. The term may
  include a written statement, a statement by electronic means, or any other unambiguous affirmative action.
          (b) The term does not include:
          (i) acceptance of a general or broad term of use or similar document that contains descriptions of
  personal data processing along with other unrelated information;
          (ii) hovering over, muting, pausing, or closing a given piece of content; or
          (iii) an agreement obtained using dark patterns.
          (6) (a) "Consumer" means an individual who is a resident of this state.
          (b) The term does not include an individual acting in a commercial or employment context or as an
  employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or
  government agency whose communications or transactions with the controller occur solely within the context of
  that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.
          (7) "Control" or "controlled" means:
          (a) ownership of or the power to vote more than 50% of the outstanding shares of any class of voting
  security of a company;
          (b) control in any manner over the election of a majority of the directors or of individuals exercising
  similar functions; or
          (c) the power to exercise controlling influence over the management of a company.
          (8) "Controller" means an individual who or legal entity that, alone or jointly with others, determines the
  purpose and means of processing personal data.
                                                                 -3-                                                LC 722
                                                    Unofficial Draft Copy
****                                                As of: 11/01/2024, 02:50:50
69th Legislature 2025                               Drafter: Joseph Carroll, ****                                     LC 0722
           (9) "Dark pattern" means a user interface designed or manipulated with the effect of substantially
  subverting or impairing user autonomy, decision-making, or choice.
           (10) "Decisions that produce legal or similarly significant effects concerning the consumer" means
  decisions made by the controller that result in the provision or denial by the controller of financial or lending
  services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities,
  health care services, or access to necessities such as food and water.
           (11) "De-identified data" means data that cannot be used to reasonably infer information about or
  otherwise be linked to an identified or identifiable individual or a device linked to the individual if the controller
  that possesses the data:
           (a) takes reasonable measures to ensure that the data cannot be associated with an individual;
           (b) publicly commits to process the data in a de-identified fashion only and to not attempt to re-identify
  the data; and
           (c) contractually obligates any recipients of the data to satisfy the criteria set forth in subsections (11)(a)
  and (11)(b).
           (12) "Identified or identifiable individual" means an individual who can be readily identified, directly or
  indirectly.
           (13) "Institution of higher education" means any individual who or school, board, association, limited
  liability company, or corporation that is licensed or accredited to offer one or more programs of higher learning
  leading to one or more degrees.
           (14) "Nonprofit organization" means any organization that is exempt from taxation under section
  501(c)(3), 501(c)(4), 501(c)(6) or 501(c)(12) of the Internal Revenue Code of 1986 or any subsequent
  corresponding internal revenue code of the United States as amended from time to time.
           (15) (a) "Personal data" means any information that is linked or reasonably linkable to an identified or
  identifiable individual.
           (b) The term does not include de-identified data or publicly available information.
           (16) (a) "Precise geolocation data" means information derived from technology, including but not limited
  to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies
  the specific location of an individual with precision and accuracy within a radius of 1,750 feet.
                                                                 -4-                                                    LC 722
                                                     Unofficial Draft Copy
****                                                 As of: 11/01/2024, 02:50:50
69th Legislature 2025                                Drafter: Joseph Carroll, ****                                  LC 0722
           (b) The term does not include the content of communications or any data generated by or connected to
  advanced utility metering infrastructure systems or equipment for use by a utility.
           (17) "Process" or "processing" means any operation or set of operations performed, whether by manual
  or automated means, on personal data or on sets of personal data, such as the collection, use, storage,
  disclosure, analysis, deletion, or modification of personal data.
           (18) "Processor" means an individual who or legal entity that processes personal data on behalf of a
  controller.
           (19) "Profiling" means any form of automated processing performed on personal data to evaluate,
  analyze, or predict personal aspects related to an identified or identifiable individual's economic situation,
  health, personal preferences, interests, reliability, behavior, location, or movements.
           (20) "Protected health information" has the same meaning as provided in the privacy regulations of the
  federal Health Insurance Portability and Accountability Act of 1996.
           (21) "Pseudonymous data" means personal data that cannot be attributed to a specific individual
  without the use of additional information, provided the additional information is kept separately and is subject to
  appropriate technical and organizational measures to ensure that the personal data is not attributed to an
  identified or identifiable individual.
           (22) "Publicly available information" means information that:
           (a) is lawfully made available through federal, state, or municipal government records or widely
  distributed media; or
           (b) a controller has a reasonable basis to believe a consumer has lawfully made available to the public.
           (23) (a) "Sale of personal data" means the exchange of personal data for monetary or other valuable
  consideration by the controller to a third party.
           (b) The term does not include:
           (i) the disclosure of personal data to a processor that processes the personal data on behalf of the
  controller;
           (ii) the disclosure of personal data to a third party for the purposes of providing a product or service
  requested by the consumer;
           (iii) the disclosure or transfer of personal data to an affiliate of the controller;
                                                                  -5-                                                LC 722
                                                     Unofficial Draft Copy
****                                                As of: 11/01/2024, 02:50:50
69th Legislature 2025                               Drafter: Joseph Carroll, ****                                    LC 0722
          (iv) the disclosure of personal data in which the consumer directs the controller to disclose the personal
  data or intentionally uses the controller to interact with a third party;
          (v) the disclosure of personal data that the consumer:
          (A) intentionally made available to the public via a channel of mass media; and
          (B) did not restrict to a specific audience; or
          (vi) the disclosure or transfer of personal data to a third party as an asset that is part of a merger,
  acquisition, bankruptcy, or other transaction, or a proposed merger, acquisition, bankruptcy, or other
  transaction in which the third party assumes control of all or part of the controller's assets.
          (24) "Sensitive data" means personal data that includes:
          (a) data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or
  diagnosis, information about a person's sex life, sexual orientation, or citizenship or immigration status;
          (b) the processing of genetic or biometric data for the purpose of uniquely identifying an individual;
          (c) personal data collected from a known child; or
          (d) precise geolocation data.
          (25) (a) "Targeted advertising" means displaying advertisements to a consumer in which the
  advertisement is selected based on personal data obtained or inferred from that consumer's activities over time
  and across nonaffiliated internet websites or online applications to predict the consumer's preferences or
  interests.
          (b) The term does not include:
          (i) advertisements based on activities within a controller's own internet websites or online applications;
          (ii) advertisements based on the context of a consumer's current search query or visit to an internet
  website or online application;
          (iii) advertisements directed to a consumer in response to the consumer's request for information or
  feedback; or
          (iv) processing personal data solely to measure or report advertising frequency, performance, or reach.
          (26) "Third party" means an individual or legal entity, such as a public authority, agency, or body, other
  than the consumer, controller, or processor or an affiliate of the controller or processor.
          (27) "Trade secret" has the same meaning as provided in 30-14-402."
                                                                 -6-                                                  LC 722
                                                         Unofficial Draft Copy
****                                                     As of: 11/01/2024, 02:50:50
69th Legislature 2025                                    Drafter: Joseph Carroll, ****                                   LC 0722
  1
             Section 9. Section 30-14-2803, MCA, is amended to read:
             "30-14-2803.    Applicability. The provisions of this part apply to persons that conduct business in this
  state or persons that produce products or services that are targeted to residents of this state and:
             (1) control or process the personal data of not less than 50,000 consumers, excluding personal data
  controlled or processed solely for the purpose of completing a payment transaction; or
             (2) control or process the personal data of not less than 25,000 consumers and derive more than 25%
  of gross revenue from the sale of personal data."
  9
             Section 10. Section 30-14-2804, MCA, is amended to read:
             "30-14-2804.    Exemptions. (1) This part does not apply to any:
             (a) body, authority, board, bureau, commission, district, or agency of this state or any political
  subdivision of this state;
             (b) nonprofit organization;
             (c) institution of higher education;
             (d) national securities association that is registered under 15 U.S.C. 78o-3 of the federal Securities
  Exchange Act of 1934, as amended;
             (e) financial institution or an affiliate of a financial institution governed by, or personal data collected,
  processed, sold, or disclosed in accordance with, Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801, et
  seq.; or
             (f) covered entity or business associate as defined in the privacy regulations of the federal Health
  Insurance Portability and Accountability Act of 1996, 45 CFR 160.103.
             (2) Information and data exempt from this part include:
             (a) protected health information under the privacy regulations of the federal Health Insurance Portability
 2