Legislation Document

AMEND House Bill No. 262 on line 7 by deleting " if categorized or organized for dissemination to third parties " after " consumer, " and before the colon therein and inserting in lieu thereof " if it is categorized or organized, or is intended to be categorized or organized, for sale or license to third parties ".

FURTHER AMEND House Bill No. 262 by deleting lines 23 through 27 in their entirety and inserting in lieu thereof the following:

“ (2) “Business” means an entity, including a sole proprietorship, partnership, corporation, association, limited liability company, or other group, however organized and whether or not organized to operate at a profit. ”

FURTHER AMEND House Bill No. 262 by inserting the following after line 28 and before line 29 and redesignating accordingly:

" (4) "Consumer Protection Unit" means the Division of Consumer Protection established in Subchapter II, Chapter 25 of Title 29 and any other individuals in the Department of Justice given responsibility for enforcing this chapter. ”

FURTHER AMEND House Bill No. 262 by deleting lines 29 through 38 in their entirety and inserting in lieu thereof the following and redesignating accordingly:

" (5) a. "Data market participant" means a business that both (i) knowingly maintains or collects the brokered personal information of at least 500 consumers and (ii) either sells or licenses such information to one or more independently operated businesses. "

FURTHER AMEND House Bill No. 262 on lines 40, 59, 62, 86, 87, 89, 90, 95, 96, 98, 100, 103, 106, 115, 116, 118, 127, 129, 134, 136, 184, 186, 193, 201, 202, 203, 213, 215, 223, 250, and 252 by deleting " data broker " every time it appears therein and inserting in lieu thereof " data market participant ".

FURTHER AMEND House Bill No. 262 on line 53 by deleting " incidental " after " both " and before " to " and inserting in lieu thereof " pursuant ".

FURTHER AMEND House Bill No.262 by inserting after line 58 and before line 59 the following:

“ d. The term “data market participant” does not include a financial institution or an affiliate of a financial institution, all as defined in 15 U.S.C. § 6809, to the extent that the financial institution or affiliate is subject to Title V of the Gramm Leach Bliley Act (15 U.S.C. § 6801, et seq., as amended) and the rules and implementing regulations promulgated thereunder. ”

FURTHER AMEND House Bill No. 262 by inserting the following after line 75 and before line 76 and redesignating accordingly:

" (9) "Publicly available information" means brokered personal information that is lawfully made readily available to the general public by a governmental entity or from widely distributed media. "

FURTHER AMEND House Bill No. 262 by inserting after line 77 and before line 78 and redesignating accordingly:

“ (11) “Sell” means to transfer brokered personal information from a business to a third party in exchange for monetary consideration. ”

FURTHER AMEND House Bill No. 262 by inserting the following after line 77 and before line 78 and redesignating accordingly:

" (12) "Third-party service provider" means a vendor or other person that provides a service to a data market participant pursuant to a contract, and includes a business that provides re-insurance services to an insurance company and a "business associate" as defined in the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, as amended). "

FURTHER AMEND House Bill No. 262 by deleting “ shall not ” as it appears on lines 79, 82, 86, and 89, and substituting in lieu thereof “ may not ”.

FURTHER AMEND House Bill No. 262 on line 80 by deleting " data collector’s " where it appears therein and inserting in lieu thereof " person’s ".

FURTHER AMEND House Bill No. 262 on lines 87 and 90 by deleting “ or reasonably should know ” where it appears therein.

FURTHER AMEND House Bill No. 262 on line 92 by deleting " A " after " (e) " and before " violation " and inserting in lieu thereof " Notwithstanding anything in § 2513(b)(3) of this title to the contrary, a ".

FURTHER AMEND House Bill No. 262 on line 94 by deleting " data brokers " where it appears therein and inserting in lieu thereof " data market participants ".

FURTHER AMEND House Bill No. 262 on line 108 by deleting " 2022 " where it appears therein and inserting in lieu thereof " 2023 ".

FURTHER AMEND House Bill No. 262 on line 110 by deleting " 2021 " where it appears therein and inserting in lieu thereof " 2022 ".

FURTHER AMEND House Bill No. 262 on lines 116, 136, 188, 190, and 193 by deleting " it " where it appears therein and inserting in lieu thereof " the data market participant ".

FURTHER AMEND House Bill No. 262 on lines 118, 119, 131, 212, 217, 218, and 224 by deleting " data broker’s " where it appears therein and inserting in lieu thereof " data market participant’s ".

FURTHER AMEND House Bill No. 262 by deleting lines 139 through 179 in their entirety and substituting in lieu thereof the following:

“ g. Answers in the provided form to each of the following exemplar questions:

1. Question: Are you a data collector, meaning that you initially collect consumer data directly from consumers? Answer Choices: yes; no.

2. Question: Are you a third-party data broker, meaning that you receive data about consumers with whom you do not have a direct relationship (e.g., employee, contractor, agent, investor, donor, customer, client, subscriber, user, or other similar relationship in which the consumer would be aware that you receive the consumer’s personal information directly from the consumer)? Answer Choices: yes; no.

3. Question: Identify the six-digit NAICS (North American Industry Classification System) Code for your business.

4. Question: Which of the following categories of consumer data do you collect directly from consumers and from consumers’ devices? Answer Choices (indicate all that apply): (0) none; (1) name, telephone, or contact information; (2) demographic information, such as age, gender, gender-identity; (2a) data related to the assignment of a consumer to predicted demographic categories; (3) race, nationality, ethnicity, or sexual preference data; (4) geolocation data; (5) financial account data; (6) income or wealth data; (7) employment data; (8) biometric data; (9) device-based user activity data; (10) health data; (11) genetic data; (12) social security number or other government-issued identification number; (13) internet browsing data; (14) information on a consumer’s purchasing history; (15) date of birth; (15) criminal history; (16) information on a consumer’s status as a victim of a crime; (17) other.

5. Question: Which of the following categories of consumer data, listed in question 4, do you purchase or license from other data market participants?

6. Question: Which of the following categories of consumer data, listed in question 4, do you sell or license to other third parties?

7. Question: To which of the following categories of third party do you sell or license such consumer data? Answer Choices (indicate all that apply): (0) none; (1) financial institutions; (2) insurance providers; (3) healthcare providers; (3) non-profit organizations; (4) law enforcement agencies; (5) non-law enforcement governmental agencies or subdivisions; (6) advertising platforms; (7) lead generators; (8) charitable solicitors; (9) non-US based businesses; (10) non-US governments; (11) third-party data brokers; (12) other.

8. Question: Do you limit the use of brokered personal information by a purchaser or licensee receiving brokered personal information from you? Answer Choices (indicate all that apply): (1) Yes, we require all recipients to comply with our privacy policies that are applicable to such information when in our control; (2) Yes, we contractually limit use to those purposes set forth in our contract; (3) Yes, we prohibit resale; (4) Yes, we limit uses in ways other than those methods listed in answer choices (1), (2) and (3); (5) No.

9. Question: If you answered “yes” to the preceding question, what steps do you take to ensure the purchaser’s or licensee’s compliance with those limitations? Answer Choices (indicate all that apply): (1) maintain a right to audit or inspect the purchaser or licensee; (2) require and receive periodic reports on compliance from the purchaser or licensee; (3) conduct periodic not-for-cause audits or inspections of the purchaser or licensee; (4) conduct for-cause audits or inspections of the purchaser or licensee; (5) other.

10. Question: How many complaints or reports have you received about the use, sale, licensing, or other disclosure of consumers brokered personal information in a manner incompatible with its collection?

11. Question: Have you received any reports from persons to whom you sold or licensed brokered personal information of any violation of the terms of such sale or license?

12. Question: Have you terminated the sale or license of any brokered personal information based in whole or in part on any violation of the terms of such sale or license?

13. Question: For any brokered personal information that you purchase or license from a third party, do you comply with the privacy policies of the third party? Answer Choices: (1) Yes; (2) No.”

FURTHER AMEND House Bill No. 262 by inserting the following after line 192 and before line 193 and redesignating accordingly:

" (c) A business that does not sell or license brokered personal information does not have to register under this section. "

FURTHER AMEND House Bill No. 262 on line 204 by inserting " one or " after " in " and before " more " therein.

FURTHER AMEND House Bill No. 262 on line 223 by deleting " state " where it appears therein and inserting in lieu thereof " State ".

FURTHER AMEND House Bill No. 262 on line 224 by inserting " including the Health Insurance Portability and Accountability Act of 1996 (P.L. 104-191, as amended), the Gramm Leach Bliley Act (15 U.S.C. § 6801, et seq., as amended), the Fair Credit Reporting Act (15 U.S.C. § 1681, et seq., as amended), and the Delaware Insurance Data Security Act (Chapter 86 of Title 18), " after " brokered personal information, " and before " and " therein.

FURTHER AMEND House Bill No. 262 on lines 224 and 225 by inserting " required by this section " after " program " and before " conforms " therein.

FURTHER AMEND House Bill No. 262 on line 225 by inserting " or State " after " federal " and before " law " therein.

FURTHER AMEND House Bill No. 262 by deleting lines 226 and 227 in their entirety and inserting in lieu thereof the following:

" (d) Pursuant to the enforcement duties and powers of the Director of Consumer Protection of the Department of Justice under Chapter 25 of Title 29, the Attorney General may bring an action in law or equity to address the violations of this section and for other relief that may be appropriate to ensure proper compliance with this section or to recover direct economic damages resulting from a violation, or both. The provisions of this section are not exclusive and do not relieve a person subject to this section from compliance with all other applicable provisions of law.

(e) Nothing in this section is intended to modify any right which a person may have at common law, by statute, or otherwise. "

FURTHER AMEND House Bill No. 262 on line 228 by deleting " Data Broker Fund " where it appears therein and inserting in lieu thereof " Privacy Protection Fund. ".

FURTHER AMEND House Bill No. 262 on line 229 by deleting " Internet " where it appears therein.