HB 380

Summary

As enrolled: - Lowers the applicability thresholds of the state's data privacy act, expanding the number of businesses subject to the law. Includes third parties who acquire personal data from a controller. - Clarifies exemptions for insurers, banks, and securities agents, brokers, and advisers. - Creates a right to confirm inferences derived from personal data. Limits right to obtain a list of third parties. Limits right of access for certain personal data. - Requires controllers that provide reports used in automated decisions with legal or similarly significant effects to contractually require third parties to provide adverse-action notices, disclose the personal data relied upon, inform residents of their rights, and offer human review where technically feasible. - Expands the definition of "sensitive data" to include inferences made from personal data, neural data, financial account information, or government ID numbers. - Requires controllers to conduct due diligence on and enter into binding contracts with third parties prior to data disclosure, and establishes direct legal obligations for third parties who receive personal data. - Mandates that controllers conduct and document a detailed impact assessment for profiling used in automated decisions that produce legal or similarly significant effects on a consumer. - Note: The 5/21/2026 amendment, retained in the enrolled bill, modifies health care-related exemptions. The amendment also exempts credit reporting and allows the sale of sensitive data when strictly necessary to provide a consumer-requested product or service, provided the controller gives clear notice and receives consent.

Sponsor

Legislative History

Quick Actions

Details

Related Legislation