19.0780.03000
Sixty-sixth
Legislative Assembly HOUSE BILL NO. 1485
of North Dakota
Introduced by
Representatives Kasper, Becker, Bellew, Heinert, Lefor, Louser, D. Ruby
Senators Bekkedahl, Burckhard, Kreun, J. Roers, Rust
1 A BILL for an Act to create and enact chapter 51-37 of the North Dakota Century Code, relating
2 to protection against the disclosure of personal information; and to provide a penalty.
3 BE IT ENACTED BY THE LEGISLATIVE ASSEMBLY OF NORTH DAKOTA:
4 SECTION 1. Chapter 51-37 of the North Dakota Century Code is created and enacted as
5 follows:
6 51-37-01. Definitions.
7 For purposes of this chapter:
8 1. "Covered entity" means a partnership, limited liability company, corporation, or other
9 legal entity that collects consumers' personal information, does business in the state,
10 and:
11 a. Has annual gross revenues in excess of twenty-five million dollars;
12 b. Annually buys, receives, sells, or shares personal information of at least fifty
13 thousand consumers, households, or devices; or
14 c. Derives at least fifty percent of its annual revenues from selling personal
15 information.
16 2. "Personal information" means information that identifies, describes, or could
17 reasonably be linked with a particular individual. The term does not include publicly
18 available information lawfully made available to the general public from federal, state,
19 or local government records. The term includes:
20 a. Personal identifiers including real name, alias, postal address, unique personal
21 identifier, online identifier internet protocol address, electronic mail address,
22 account name, social security number, date of birth, operator's license number,
23 passport number, or other similar identifier.
24 b. Biometric information.
Page No. 1 19.0780.03000
 Sixty-sixth
Legislative Assembly
1 c. Commercial information, including records of personal property, products or
2 services purchased, obtained, or considered, or other purchasing or consuming
3 histories or tendencies.
4 d. Internet or other electronic network activity information, including browsing
5 history, search history, and information regarding an individual's interaction with
6 an internet website, application, or advertisement.
7 e. Geolocation data.
8 f. Inferences drawn from any of the information identified in this subsection to
9 create a profile about a consumer reflecting the individual's preferences,
10 characteristics, psychological trends, predispositions, behavior, attitudes,
11 intelligence, abilities, and aptitudes.
12 51-37-02. Prohibition against disclosure of personal information except upon written
13 consent.
14 1. A covered entity may not disclose any part of a record containing an individual's
15 personal information prepared or maintained by the covered entity to any person,
16 other than to the individual who is the subject of the record or as provided in this
17 chapter, without the express written consent of the individual.
18 2. To obtain an individual's express written consent:
19 a. A covered entity shall send by mail or electronic mail a brief, one-to-two page
20 summary of the terms and conditions of using the covered entity's services
21 including a description of how, when, and to and from whom the covered entity
22 buys, receives, sells, and shares an individual's personal information; and
23 b. The covered entity must receive an affirmative response from the individual, or
24 the individual's parent or legal guardian if the individual is under eighteen years of
25 age, consenting to the use of the individual's personal information as described in
26 the summary.
27 3. This section does not apply to:
28 a. A disclosure to any person pursuant to a subpoena or court order;
29 b. A disclosure that is discoverable pursuant to the North Dakota Rules of Civil
30 Procedure;
31 c. A disclosure to any person pursuant to a lawful search warrant; or
Page No. 2 19.0780.03000
 Sixty-sixth
Legislative Assembly
1 d. A disclosure required by law.
2 51-37-03. Accounting of personal information.
3 1. Within forty-five days after receiving a request from an individual, a covered entity
4 shall disclose to the individual the categories and specific pieces of personal
5 information the covered entity possesses regarding the individual or the individual's
6 minor child.
7 2. To ensure the covered entity discloses the requested personal information to the
8 appropriate individual, a covered entity shall implement appropriate processes and
9 safeguards for verifying an individual's request under subsection 1.
10 51-37-04. Enforcement - Powers - Remedies - Penalties.
11 If an individual has reasonable cause to believe the personal information of the individual or
12 the individual's minor child is purchased, received, sold, or shared by a covered entity in
13 violation of this chapter, the individual may submit a complaint to the attorney general. To
14 enforce this chapter, the attorney general may:
15 1. Seek and obtain in an action in a district court an injunction prohibiting the covered
16 entity from continuing the unlawful practice, engaging in the unlawful practice, or doing
17 any act in furtherance of the unlawful practice after appropriate notice to the covered
18 entity. The notice must state generally the relief sought and be served at least ten
19 days before the hearing of the action. The court may make an order or judgment as
20 may be necessary to prevent the use or employment by a covered entity of any
21 unlawful practices.
22 2. Issue a cease and desist order, without notice and hearing, which the attorney general
23 deems necessary or appropriate in the public interest.
24 3. Impose by order and collect a civil penalty against a covered entity found in an
25 adjudicative proceeding to have violated a cease and desist order issued under this
26 section, in an amount not less than one hundred thousand dollars and not more than
27 two hundred fifty thousand dollars for each violation.
28 4. Bring an action in district court to recover penalties under this section.
29 5. A covered entity aggrieved by an order issued under this section may request a
30 hearing before the attorney general if a written request is made within ten days after
31 the receipt of the order. An adjudicative proceeding under this section must be
Page No. 3 19.0780.03000
 Sixty-sixth
Legislative Assembly
1 conducted in accordance with chapter 28-32, unless otherwise specifically provided
2 herein. If the attorney general prevails in an adjudicative proceeding under this
3 section, the attorney general may assess the nonprevailing covered entity for all
4 adjudicative proceeding and hearing costs, including reasonable attorney's fees,
5 investigation fees, costs, and expenses of any investigation and action.
6 51-37-05. Private right of action.
7 If an individual's personal information is purchased, received, sold, or shared by a covered
8 entity in violation of this chapter, the individual may bring a civil action in a court of this state
9 with jurisdiction over the covered entity to recover damages, costs, and fees, including
10 reasonable attorney's fees; or obtain injunctive or declaratory relief; or any other relief the court
11 deems proper.
Page No. 4 19.0780.03000