Text of AK HB 367 (2026)

HB0367a -1- HB 367 New Text Underlined [DELETED TEXT BRACKETED] 34-LS1485\N HOUSE BILL NO. 367 IN THE LEGISLATURE OF THE STATE OF ALASKA THIRTY-FOURTH LEGISLATURE - SECOND SESSION BY REPRESENTATIVE STORY Introduced: 2/23/26 Referred: Judiciary, Finance A BILL FOR AN ACT ENTITLED "An Act relating to the privacy of consumer personal information; establishing the 1 Consumer Personal Information Privacy Act; establishing data broker registration 2 requirements; relating to social security numbers; making certain violations unfair or 3 deceptive trade practices; and providing for an effective date." 4 BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 5 * Section 1. AS 44.33.020(a) is amended by adding a new paragraph to read: 6 (45) establish and maintain a data broker registry established under 7 AS 45.48.900. 8 * Sec. 2. AS 45.48.430(b) is amended to read: 9 (b) The prohibition in (a) of this section does not apply if 10 (1) the disclosure is authorized by local, state, or federal law, including 11 AS 45.48.800 - 45.48.945 or a regulation adopted under AS 45.48.470; 12 (2) the person is engaging in the business of government and 13 (A) is authorized by law to disclose the individual's social 14 34-LS1485\N HB 367 -2- HB0367a New Text Underlined [DELETED TEXT BRACKETED] security number; or 1 (B) the disclosure of the individual's social security number is 2 required for the performance of the person's duties or responsibilities as 3 provided by law; 4 (3) the disclosure is to a person subject to or for a transaction regulated 5 by the Gramm-Leach-Bliley Financial Modernization Act, and the disclosure is for a 6 purpose authorized by the Gramm-Leach-Bliley Financial Modernization Act or to 7 facilitate a transaction of the individual; 8 (4) the disclosure is to a person subject to or for a transaction regulated 9 by the Fair Credit Reporting Act, and the disclosure is for a purpose authorized by the 10 Fair Credit Reporting Act; 11 (5) the disclosure is part of a report prepared by a consumer credit 12 reporting agency in response to a request by a person and the person submits the social 13 security number as part of the request to the consumer credit reporting agency for the 14 preparation of the report; or 15 (6) the disclosure is for a background check on the individual, identity 16 verification, fraud prevention, medical treatment, law enforcement or other 17 government purposes, or the individual's employment, including employment benefits. 18 * Sec. 3. AS 45.48.450(b) is amended to read: 19 (b) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, and 20 except as provided under AS 45.48.800 - 45.48.945 or for an agent under (a) of this 21 section, a person may disclose an individual's social security number to an 22 independent contractor of the person to facilitate the purpose or transaction for which 23 the individual initially provided the social security number to the person, but the 24 independent contractor may not use the social security number for another purpose or 25 make an unauthorized disclosure of the individual's personal information. In this 26 subsection, "independent contractor" includes a debt collector. 27 * Sec. 4. AS 45.48 is amended by adding new sections to read: 28 Article 6A. Consumer Personal Information Privacy. 29 Sec. 45.48.800. Notice before collection; disclosure of information; other 30 notices. (a) A business that collects personal information from a consumer shall notify 31 34-LS1485\N HB0367a -3- HB 367 New Text Underlined [DELETED TEXT BRACKETED] the consumer before collecting the information. Notification to the consumer must 1 clearly and conspicuously indicate the categories of personal information that will be 2 collected, the specific purposes for which each category of personal information will 3 be used, the consumer's right under AS 45.48.835 not to have the consumer's personal 4 information sold, shared, or disclosed, and the limitations established under 5 AS 45.48.840 on the use of the consumer's precise geolocation data by the business. A 6 business may not collect an additional category of personal information or use the 7 collected personal information for an additional purpose without first notifying the 8 consumer in accordance with this section. 9 (b) A business shall maintain, and update at least once every 12 months, in the 10 business's online privacy policies and in any state-specific description of consumers' 11 privacy rights, or on the business's Internet website if the business does not maintain 12 online privacy policies or description, the following information: 13 (1) a description of a consumer's rights under AS 45.48.800 - 14 45.48.945; 15 (2) all the designated methods of the business by which a consumer 16 can request access to or deletion of information as provided under AS 45.48.800 - 17 45.48.945; 18 (3) a list of the categories of consumer personal information that the 19 business collected, sold, or disclosed for a business or commercial purpose in the 20 preceding 12 months, and a designation of that information as collected, sold, or 21 disclosed for a business or commercial purpose; or, if the business did not collect, sell, 22 or disclose any consumer personal information for a business or commercial purpose, 23 a disclosure of that fact; 24 (4) the categories of sources from which the consumer personal 25 information was collected; in this paragraph, "categories of sources" includes the 26 consumer, advertising networks, Internet service providers, data analytics providers, 27 government entities, operating systems and platforms, social networks, data brokers, 28 other sources listed in regulations adopted under AS 45.48.800 - 45.48.945, and other 29 types or groupings of persons or entities from which a business collects personal 30 information about consumers, described with enough particularity to provide 31 34-LS1485\N HB 367 -4- HB0367a New Text Underlined [DELETED TEXT BRACKETED] consumers with a meaningful understanding of the type of person or entity; 1 (5) a description of the business purpose or commercial purpose for 2 which each category of consumer personal information was collected, sold, or 3 disclosed; 4 (6) the categories of third parties to whom the business sold or 5 disclosed consumer personal information; in this paragraph, "categories of third 6 parties" includes advertising networks, Internet service providers, data analytics 7 providers, government entities, operating systems and platforms, social networks, data 8 brokers, other sources listed in regulations adopted under AS 45.48.800 - 45.48.945, 9 and other types or groupings of third parties with whom the business shares personal 10 information, described with enough particularity to provide consumers with a 11 meaningful understanding of the type of third party; 12 (7) a description of a consumer's right to request the specific pieces of 13 the consumer's personal information that the business collected; 14 (8) a statement that information collected to verify a consumer's 15 disclosure or deletion request shall only be used as provided in AS 45.48.850(d) and 16 (e)(1). 17 (c) In addition to the requirements under (b) of this section, a business shall 18 include on the home page of the business's Internet website under the business's online 19 privacy policies, if the business has online privacy policies, and under any state- 20 specific description of consumers' privacy rights, the following: 21 (1) a clear and conspicuous link to an Internet website page titled "Do 22 Not Collect or Sell My Personal Information" that enables a consumer to exercise the 23 consumer's rights under AS 45.48.800 - 45.48.945; a business may not require a 24 consumer to create an account to access this Internet website page or to exercise the 25 consumer's rights under AS 45.48.800 - 45.48.945; and 26 (2) a description of a consumer's rights under AS 45.48.800 - 27 45.48.945. 28 (d) A business may comply with (c) of this section by including the required 29 content on a separate and additional Internet website page that is dedicated to 30 consumers. 31 34-LS1485\N HB0367a -5- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (e) A business shall include on an Internet website page dedicated to 1 consumers the content required under (b) and (c) of this section and reasonably ensure 2 that consumers are directed to the alternative Internet website. 3 (f) In this section, "home page" means 4 (1) the introductory page of an Internet website where personal 5 information is collected; 6 (2) in the case of a mobile application, the application's platform page 7 or download page, an electronic link within the application, and any other location that 8 allows consumers to review the notice required by (a) of this section. 9 Sec. 45.48.805. Limits on use, processing, collection, sharing, and retention 10 of personal information. (a) A business that collects a consumer's personal 11 information shall limit its collection and sharing of the personal information with third 12 parties to what is reasonably necessary for the business to provide a service or conduct 13 an activity that a consumer has requested, or has consented to, or that is reasonably 14 necessary for security or fraud prevention. In this subsection, "reasonably necessary 15 for security or fraud prevention" does not include profiting financially from the 16 personal information. 17 (b) A business that collects a consumer's personal information is not required 18 to retain personal information collected for a single one-time transaction if the 19 business does not sell or disclose the information. 20 (c) Except for the collection and sharing of personal information under (a) of 21 this section, a business shall limit the business's use and retention of collected personal 22 information to what is reasonably necessary to provide a service or conduct an activity 23 that a consumer has requested or consented to, or for a related operational purpose; 24 however, personal information that is collected or retained solely for security or fraud 25 prevention may not be used for operational purposes. 26 Sec. 45.48.810. Notification of business upon receipt or disclosure of 27 personal information. (a) When a person receives personal information for a business 28 purpose or commercial purpose that a business originally collected from a consumer, 29 the person shall notify the business that the person possesses the personal information 30 and provide the person's contact information. The person shall provide updated contact 31 34-LS1485\N HB 367 -6- HB0367a New Text Underlined [DELETED TEXT BRACKETED] information to the business if the person's contact information changes. 1 (b) A person who receives personal information that a business originally 2 collected from a consumer, and who discloses the personal information to another 3 person for a business purpose or commercial purpose, shall notify the business that 4 originally collected the information not later than 10 days after the disclosure. The 5 notification must include the contact information of the person to whom the personal 6 information was disclosed. 7 (c) A person that receives personal information that a business originally 8 collected from a consumer shall either de-identify the personal information or 9 maintain the personal information in a way that the person can readily comply with a 10 disclosure or deletion request under AS 45.48.800 - 45.48.945. 11 Sec. 45.48.815. Required records. A business that collects or has collected 12 personal information from a consumer shall maintain records of each person to whom 13 the business discloses the personal information. The business shall also maintain all 14 records provided to the business under AS 45.48.810(a) and (b). 15 Sec. 45.48.820. Request for disclosure of collected personal information. 16 (a) A consumer may request a business that collects or collected the consumer's 17 personal information to disclose to the consumer 18 (1) the categories and specific pieces of personal information that the 19 business collects or collected within the five years preceding the date of the request; 20 (2) the sources from which the business collects or collected each 21 category of personal information; and 22 (3) the business purpose or commercial purpose for the collection of 23 each category of personal information. 24 (b) A business shall respond to a consumer request under this section as 25 required by AS 45.48.850. 26 Sec. 45.48.825. Request for deletion of personal information. (a) A 27 consumer may request a business to delete any of the consumer's personal information 28 collected by the business from the consumer within the five years preceding the date 29 of the request. 30 (b) Upon receiving a consumer request under this section, a business shall 31 34-LS1485\N HB0367a -7- HB 367 New Text Underlined [DELETED TEXT BRACKETED] delete from the business's records the information identified in the request. 1 (c) Within 45 days after a consumer's deletion request, a business that receives 2 a deletion request under (b) of this section shall direct all persons to whom a business 3 disclosed records under AS 45.48.810 to delete the personal information and provide a 4 written statement verifying that the information has been deleted. A person shall 5 comply with a direction under this subsection. The business shall immediately provide 6 written notification to the attorney general and the consumer of a person who fails to 7 provide written verification of compliance. 8 (d) A person is not required to delete personal information under (c) of this 9 section if the person maintains the personal information to 10 (1) complete the transaction for which the personal information was 11 collected; 12 (2) provide a good or service requested or reasonably anticipated 13 within an ongoing business relationship with the consumer; 14 (3) fulfill the terms of a written warranty or product recall conducted in 15 accordance with federal law; 16 (4) perform a contract between the business and consumer; 17 (5) detect security incidents, protect against malicious, deceptive, 18 fraudulent, or illegal activity, or prosecute the person responsible for that activity; 19 (6) identify and repair errors that impair the existing intended 20 functionality of a product or service; 21 (7) exercise a right provided for by law, including the right under the 22 First Amendment of the United States Constitution and art. I, sec. 5, of the 23 Constitution of the State of Alaska to freedom of speech, or ensure the right of another 24 consumer to exercise that consumer's right to freedom of speech; 25 (8) comply with a search warrant, subpoena, or court order; 26 (9) engage in public or peer-reviewed scientific, historical, or 27 statistical research in the public interest that adheres to all other applicable ethics and 28 privacy laws, if 29 (A) the deletion of information is likely to seriously impair or 30 render impossible the achievement of the research; and 31 34-LS1485\N HB 367 -8- HB0367a New Text Underlined [DELETED TEXT BRACKETED] (B) the consumer has provided consent to the research; 1 (10) enable solely internal uses that are reasonably aligned with the 2 consumer's expectations, based on the consumer's relationship with the business; or 3 (11) comply with a legal obligation. 4 (e) A person may not disclose personal information that a business collected 5 from a consumer unless the personal information is disclosed in accordance with a 6 contract that requires the recipient to comply with a deletion request issued under 7 AS 45.48.800 - 45.48.945. 8 Sec. 45.48.830. Request for disclosure of personal information sold or 9 disclosed for a business purpose or commercial purpose. (a) A consumer may 10 request that a business that sold or disclosed the consumer's personal information for a 11 business purpose or commercial purpose within the last five years disclose to the 12 consumer 13 (1) the third parties subject to AS 45.48.810 in possession of the 14 consumer's personal information; 15 (2) the categories of personal information or specific pieces of personal 16 information that were sold or disclosed to each third party for a business purpose or 17 commercial purpose; 18 (3) for the third parties to which the business directly disclosed the 19 consumer's personal information for a business purpose or commercial purpose, the 20 business purpose or commercial purpose for disclosing each category of personal 21 information. 22 (b) A business shall respond to a consumer request under this section as 23 required by AS 45.48.850. 24 Sec. 45.48.835. Request not to sell, share, or disclose personal information. 25 (a) A consumer may, at any time, request a business not to sell, share, or disclose the 26 consumer's personal information or not to sell, share, or disclose particular categories 27 of the consumer's personal information. 28 (b) If a business collects personal information from a consumer online and the 29 consumer uses a global privacy control, the business shall treat the use of the global 30 privacy control as a valid request submitted by the consumer under (a) of this section 31 34-LS1485\N HB0367a -9- HB 367 New Text Underlined [DELETED TEXT BRACKETED] not to sell, share, or disclose the consumer's personal information. In this subsection, 1 (1) "extension" means a piece of software code that enables a 2 computer application or program to perform an activity the application or program 3 cannot do by itself; 4 (2) "global privacy control" includes a browser extension, privacy 5 setting, device setting, or other mechanism that communicates or signals the 6 consumer's choice not to have the consumer's personal information sold, shared, or 7 disclosed. 8 (c) A consumer may, as provided by regulation adopted under AS 45.48.915, 9 authorize another person solely to request that a business not sell, share, or disclose 10 the consumer's personal information, and a business shall comply with the request 11 received from the person for the consumer. 12 (d) A business shall respond to a consumer request under this section as 13 required by AS 45.48.850, unless the consumer later provides a clear and explicit 14 renunciation of the request. For one year after receiving a request under (a) - (c) of this 15 section, a business may not contact the consumer to request that the consumer 16 renounce the request. 17 (e) A business subject to this section may only use the personal information 18 collected from a consumer request under this section to comply with the request, 19 unless otherwise authorized by the consumer or by another provision of law. 20 Sec. 45.48.840. Use and disclosure of precise geolocation data. (a) A 21 business may use a consumer's precise geolocation data for other purposes than the 22 purpose disclosed under AS 45.48.800(a) if the consumer consents to the use. A 23 consumer who consents to the use of the consumer's precise geolocation data for other 24 purposes may, at any time, request that the business stop using the data for other 25 purposes. The consumer's consent must be in writing and in an agreement separate 26 from any other agreement for use, and the consumer must agree to the business's use 27 of the consumer's precise geolocation data for other purposes. 28 (b) Except as provided in (a) of this section, a business shall limit the use and 29 disclosure of a consumer's precise geolocation data to that necessary to provide goods 30 or services that a consumer requests and reasonably expects, or goods and services the 31 34-LS1485\N HB 367 -10- HB0367a New Text Underlined [DELETED TEXT BRACKETED] business reasonably expects the consumer will request. 1 (c) The provisions of AS 45.48.800 - 45.48.945 do not apply to a business that 2 uses a consumer's precise geolocation data if the consumer is an employee, contractor, 3 or vendor of the business. 4 Sec. 45.48.845. Treatment of individuals 16 years of age or under. (a) 5 Notwithstanding any other provision of AS 45.48.800 - 45.48.945, a business that has 6 actual knowledge that a consumer is 16 years of age or under may not 7 (1) disclose the personal information of the consumer for a business 8 purpose or commercial purpose, or use the consumer's precise geolocation data for a 9 purpose other than to provide goods or services that the consumer reasonably requests 10 and expects, unless the consumer's parent or guardian consents to the disclosure or 11 use; or 12 (2) sell or share the personal information of the consumer. 13 (b) A business that recklessly disregards a reasonable likelihood that a 14 consumer is 16 years of age or under is considered to have actual knowledge of the 15 consumer's age. In this subsection, "recklessly" has the meaning given in 16 AS 11.81.900(a). 17 (c) A business may not track or profile the personal information of an 18 individual who is 16 years of age or under in order to provide to the individual a 19 commercial advertisement that is based on the personal information or online activity 20 of the individual. 21 Sec. 45.48.850. Disclosure or deletion request; process. (a) A business shall 22 respond to a consumer request under AS 45.48.820 or 45.48.830 by 23 (1) providing the requested information electronically to the consumer 24 in a portable and, to the extent technically feasible, readily useable format that allows 25 the consumer to transmit the information to another person without hindrance; 26 (2) if the information provided under (1) of this subsection is not in a 27 human-readable format, providing the requested information to the consumer in a 28 format that is easily readable by a human; and 29 (3) at the consumer's request, providing the requested information by 30 mail. 31 34-LS1485\N HB0367a -11- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (b) A business subject to AS 45.48.800 - 45.48.945 shall designate at least two 1 methods for a consumer to submit a request under AS 45.48.820 - 45.48.835, 2 including, at a minimum, a toll-free telephone number and an electronic mail address. 3 If a business maintains an Internet website, the website must include an option to 4 submit requests under AS 45.48.820 - 45.48.835 on a public facing page. A designated 5 method for submitting requests may include a mailing address, electronic mail 6 address, Internet website, Internet website portal, toll-free telephone number, other 7 applicable contact information, or a new consumer-friendly means of contacting a 8 business as determined by regulation. 9 (c) A person may not charge a consumer a fee for performing a duty required 10 by AS 45.48.800 - 45.48.945. 11 (d) A person may only use the information provided by a consumer in a 12 request made under AS 45.48.820 - 45.48.835 to identify the consumer and comply 13 with the request. 14 (e) In response to a request made under AS 45.48.820 - 45.48.835, a business 15 shall 16 (1) promptly determine whether the request is a consumer request; a 17 business may not require that a consumer create an account with the business; 18 however, if the consumer maintains an account with the business, the business may 19 require the consumer to submit the request through the account; 20 (2) identify in writing the personal information subject to a disclosure 21 request; the information disclosed must 22 (A) cover the 12-month period preceding the request, or 23 another applicable period designated by the consumer; 24 (B) be designated by the most relevant category of personal 25 information; 26 (C) clearly separate information requested under AS 45.48.820 27 and 45.48.830; 28 (3) disclose and deliver the identified information in writing not later 29 than 45 days after receipt of the request; 30 (4) not later than 45 days after receipt of a deletion request, comply 31 34-LS1485\N HB 367 -12- HB0367a New Text Underlined [DELETED TEXT BRACKETED] with AS 45.48.825, and provide confirmation of compliance to the consumer. 1 (f) The time to respond to a disclosure or deletion request under (e)(3) and (4) 2 of this section may be extended once for an additional 45 days when reasonably 3 necessary. If the time to respond is extended, the business shall notify the consumer of 4 the extension. 5 (g) A business may disclose or provide confirmation of deletion of 6 information to the consumer by mail, through the consumer's account with the 7 business, or electronically at the consumer's request if the consumer does not have an 8 account with the business. 9 (h) Notwithstanding any other requirement in this section, if a consumer's 10 requests are manifestly unfounded or excessive, in particular because of the requests' 11 repetitive character, a business may either charge a reasonable fee, taking into account 12 the administrative costs of complying with the consumer's request, or refuse to act on 13 the request. The business shall notify the consumer of a decision to charge a fee or to 14 deny a request within the timeline provided under (e)(3) and (4) and (f) of this section. 15 The notification must completely explain the business's reason for finding the request 16 manifestly unfounded or excessive, including all pertinent facts. The business shall 17 bear the burden of proving that a consumer's request is manifestly unfounded or 18 excessive. 19 (i) A business is not required to respond to a disclosure or deletion request 20 under AS 45.48.825 or 45.48.830 if the consumer making the request has made two 21 consumer requests in the previous 365 days. 22 (j) A business is not required under this section to re-identify or otherwise link 23 data that, in the ordinary course of business, is not maintained in a manner that would 24 be considered personal information. 25 Sec. 45.48.855. Third-party disclosure and handling of personal 26 information. (a) A third party may not disclose personal information to another 27 person if the personal information was originally collected in violation of 28 AS 45.48.800 or 45.48.835. A third party that reasonably inquires into whether 29 personal information was collected in violation of AS 45.48.800 or 45.48.835, and 30 reasonably concludes that information was not obtained in violation of AS 45.48.800 31 34-LS1485\N HB0367a -13- HB 367 New Text Underlined [DELETED TEXT BRACKETED] or 45.48.835 may not be held liable for a violation under this section. 1 (b) A third party may not disclose a consumer's personal information for a 2 business purpose or commercial purpose unless the third party receives written 3 confirmation from the business that originally collected the personal information that 4 the information was collected in compliance with AS 45.48.800 and 45.48.835. 5 Sec. 45.48.860. Service provider obligations. (a) A service provider may not 6 (1) retain, use, or disclose personal information received from a 7 business for any purpose other than to perform the services specified in a written 8 contract with the business; 9 (2) combine personal information received from a business with 10 personal information the service provider receives from other sources, unless 11 otherwise provided in regulation; 12 (3) disclose personal information received from a business to any other 13 person without first 14 (A) receiving written consent of the business to disclose the 15 personal information to the other person; and 16 (B) entering into a written contract with the other person that 17 prohibits the other person from engaging in conduct prohibited under this 18 section. 19 (b) A person who receives personal information from a service provider may 20 not disclose the personal information to any other person. 21 Sec. 45.48.865. Exemptions. (a) AS 45.48.800 - 45.48.945 do not apply to 22 (1) protected health information that is collected by a covered entity or 23 business associate governed by the privacy, security, and breach notification rules 24 issued by the United States Department of Health and Human Services in 45 C.F.R. 25 Parts 160 and 164, established under the Health Insurance Portability and 26 Accountability Act of 1996 (P.L. 104-191) and the Health Information Technology for 27 Economic and Clinical Health Act (P.L. 111-5); in this paragraph, "protected health 28 information" has the meaning given in 45 C.F.R. 160.103; 29 (2) a covered entity governed by the privacy, security, and breach 30 notification rules issued by the United States Department of Health and Human 31 34-LS1485\N HB 367 -14- HB0367a New Text Underlined [DELETED TEXT BRACKETED] Services in 45 C.F.R. Parts 160 and 164, established under the Health Insurance 1 Portability and Accountability Act of 1996 (P.L. 104-191), to the extent the provider 2 or covered entity maintains patient information in the same manner as medical 3 information or protected health information as described in (1) of this subsection; 4 (3) information collected as part of a clinical trial subject to 45 C.F.R. 5 Part 46 (Protection of Human Subjects) under 6 (A) good clinical practice guidelines issued by the International 7 Council for Harmonisation of Technical Requirements for Pharmaceuticals for 8 Human Use; or 9 (B) human subject protection requirements of the United States 10 Food and Drug Administration; 11 (4) vehicle information or ownership information retained or shared 12 between a new motor vehicle dealer, as defined in AS 45.25.990, and the motor 13 vehicle manufacturer, as defined in AS 45.25.990, if the information is shared for the 14 purpose of or in anticipation of effectuating a vehicle repair covered by a vehicle 15 warranty or recall conducted under 49 U.S.C. 30118 - 30120, if the new motor vehicle 16 dealer or vehicle manufacturer does not sell, share, or use the information for another 17 purpose; in this paragraph, 18 (A) "ownership information" means the name of each 19 registered owner and accompanying contact information; 20 (B) "vehicle information" means the vehicle identification 21 number, the vehicle's make, model, or year, or the vehicle's odometer reading; 22 (5) a person, including a subsidiary or affiliate of the person, and data 23 that are subject to 15 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Act) and related 24 regulations; 25 (6) an individual's personal information collected by a business if the 26 business collects the personal information through the individual's 27 (A) job application made to the business; 28 (B) service as an employee, officer, or director of the business; 29 or 30 (C) work as a contractor for the business and consists only of 31 34-LS1485\N HB0367a -15- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (i) personal information used solely within the context 1 for which it was collected; 2 (ii) emergency contact information used solely for the 3 purpose of having an emergency contact on file; or 4 (iii) personal information retained solely to administer 5 benefits for the individual. 6 (b) AS 45.48.800 - 45.48.945 do not apply to the disclosure of a consumer's 7 personal information to 8 (1) comply with federal, state, or local law; 9 (2) comply with a civil, criminal, or regulatory inquiry or an 10 investigation, subpoena, or summons by federal, state, or local authorities; 11 (3) cooperate with law enforcement agencies concerning conduct or 12 activity that the person reasonably and in good faith believes may violate federal, 13 state, or local law; 14 (4) exercise or defend legal claims; 15 (5) collect, use, retain, sell, or disclose de-identified consumer personal 16 information or aggregated consumer personal information. 17 (c) AS 45.48.800 - 45.48.945 do not apply to the collection or sale of a 18 consumer's personal information if the commercial conduct takes place wholly outside 19 the state. For the purpose of this subsection, commercial conduct takes place wholly 20 outside the state if 21 (1) the business collected the information while the consumer was 22 outside the state; the exemption allowed under this subsection does not include the 23 storage of personal information, including on a personal device, while the consumer is 24 in the state and collection when the consumer and stored information later leave the 25 state; 26 (2) no part of the sale of the consumer's personal information occurred 27 in the state; and 28 (3) no personal information collected while the consumer was in the 29 state was sold. 30 (d) AS 45.48.800 - 45.48.875 and 45.48.885 - 45.48.945 do not apply to 31 34-LS1485\N HB 367 -16- HB0367a New Text Underlined [DELETED TEXT BRACKETED] (1) an activity that is subject to 15 U.S.C. 1681 - 1681x (Fair Credit 1 Reporting Act) that involves the collection, maintenance, disclosure, sale, 2 communication, or use of any personal information bearing on a consumer's 3 creditworthiness, credit standing, credit capacity, character, general reputation, 4 personal characteristics, or mode of living by a consumer reporting agency; 5 (2) a furnisher of information who provides information for use in a 6 consumer report, or a user of a consumer report, to the extent the information is used 7 as authorized under 15 U.S.C. 1681 - 1681x (Fair Credit Reporting Act); 8 (3) personal information collected, processed, sold, or disclosed under 9 18 U.S.C. 2721 - 2725 (Driver's Privacy Protection Act of 1994) and related 10 regulations. 11 (e) Except as provided in AS 45.48.835 and 45.48.880, personal information 12 contained in a written communication, oral communication, or transaction between a 13 business and a consumer is exempt from AS 45.48.800 - 45.48.945 if 14 (1) the consumer is an individual acting as an employee, owner, 15 director, officer, member, or contractor of a sole proprietorship, partnership, limited 16 liability company, corporation, association, or other legal entity that is organized or 17 operated for the profit or financial benefit of its shareholders, partners, members, or 18 other owners, or is a government agency; in this paragraph, "owner" means an 19 individual who 20 (A) owns, directly or indirectly, or has the power to vote, more 21 than 50 percent of the outstanding shares of a class of voting securities of a 22 business; 23 (B) controls, in any manner, the election of a majority of the 24 directors or of individuals exercising similar functions; or 25 (C) has the power to exercise a controlling influence over the 26 majority of the directors or of individuals exercising similar functions; and 27 (2) the communication or transaction occurs solely within the context 28 of the business exercising due diligence regarding a product or service of, the receipt 29 of a product or service from, or providing a product or service to the corporation, 30 partnership, sole proprietorship, or government agency. 31 34-LS1485\N HB0367a -17- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (f) A requirement under AS 45.48.800 - 45.48.945 does not apply if 1 (1) compliance with the requirement would violate an evidentiary 2 privilege under state law; 3 (2) the business provides personal information as part of privileged 4 communication to a person covered by an evidentiary privilege; 5 (3) the right or obligation would adversely affect a right of another 6 consumer; 7 (4) the requirement would infringe on the noncommercial activity of a 8 person or entity exercising rights under art. I, sec. 5, Constitution of the State of 9 Alaska. 10 (g) A business does not sell or share a consumer's personal information under 11 AS 45.48.800 - 45.48.945 if 12 (1) the consumer intentionally directs the business to disclose the 13 consumer's personal information to a third party, intentionally uses the business to 14 disclose the consumer's personal information to a third party, or intentionally directs 15 the business to interact with a third party, and the third party does not also disclose the 16 personal information or discloses the personal information consistent with 17 AS 45.48.800 - 45.48.945; 18 (2) the business uses or shares a unique identifier for a consumer to 19 alert third parties that the consumer has requested under AS 45.48.835 that the 20 business not sell, share, or disclose the consumer's personal information or particular 21 categories of the consumer's personal information. 22 (h) A business does not sell personal information under AS 45.48.800 - 23 45.48.945 when the business uses or shares with a service provider a consumer's 24 personal information that is necessary to perform a business purpose if 25 (1) the business has provided notice under AS 45.48.800 of the 26 personal information being used or shared; and 27 (2) the service provider does not further collect, sell, or use the 28 consumer's personal information except as necessary to perform the business purpose. 29 (i) In this section, 30 (1) "contractor" means a person who is not an employee of a business 31 34-LS1485\N HB 367 -18- HB0367a New Text Underlined [DELETED TEXT BRACKETED] but provides a service to the business under a written contract; 1 (2) "covered entity" has the meaning given in 45 C.F.R. 160.103; 2 (3) "director" has the meaning given in AS 10.06.990; 3 (4) "intentionally" does not mean hovering over, muting, pausing, or 4 closing a piece of content; 5 (5) "officer" means a person appointed or designated as an officer of a 6 corporation by or under applicable law or the corporation's articles of incorporation or 7 bylaws, or a person who performs for the corporation the functions usually performed 8 by an officer of a corporation. 9 Sec. 45.48.870. Retaliation prohibited; financial incentives. (a) A business 10 may not retaliate against a consumer in response to a consumer exercising rights under 11 AS 45.48.800 - 45.48.945. Retaliation includes 12 (1) denying goods or services; 13 (2) charging different prices or rates for goods or services, including 14 using discounts or other benefits or imposing penalties; 15 (3) providing a different level or quality of goods or services to a 16 consumer; 17 (4) suggesting that a consumer will receive a different price or rate for 18 goods or services or a different level or quality of goods or services. 19 (b) Notwithstanding (a) of this section, a business may charge a consumer a 20 different rate or provide a different level or quality of goods or services to a consumer 21 if the difference is reasonably related to the value provided to the business by the 22 consumer's personal information. 23 (c) Notwithstanding (a) of this section, a business may offer a consumer a 24 financial incentive for the collection, sale, or retention of personal information, 25 including direct payments to a consumer as compensation. A business that offers a 26 financial incentive under this subsection 27 (1) shall notify consumers of the financial incentive; 28 (2) shall obtain a consumer's consent before entering a consumer into a 29 financial incentive program; to obtain a consumer's consent under this paragraph, the 30 business shall provide the consumer access to a clear and conspicuous description of 31 34-LS1485\N HB0367a -19- HB 367 New Text Underlined [DELETED TEXT BRACKETED] the material terms of the financial incentive program; the consumer may revoke the 1 consent at any time; 2 (3) may not use financial incentive practices that are unjust, 3 unreasonable, coercive, or usurious. 4 (d) In this section, "business" does not include a newspaper. 5 Sec. 45.48.875. Transfer of information in a merger, acquisition, 6 bankruptcy, and certain other transactions. (a) A business may transfer to or share 7 with a third party a consumer's personal information as an asset that is part of a 8 business change transaction. 9 (b) If a business shares a consumer's personal information with a third party in 10 the process of evaluating and consummating a business change transaction, the 11 business shall require that the third party agree by contract to keep the personal 12 information confidential and not use the personal information for a purpose other than 13 evaluating and consummating the transaction. 14 (c) A third party under (a) of this section may not use or share the consumer's 15 personal information in a manner that is materially inconsistent with (a) of this section 16 or with the uses identified in the notification made under AS 45.48.800. 17 (d) A transfer under (a) of this section does not authorize a business to make 18 material retroactive privacy policy changes or other changes in a manner that 19 constitutes an unfair or deceptive trade practice under AS 45.50.471 - 45.50.561. 20 (e) In this section, "business change transaction" means a merger, acquisition, 21 bankruptcy, or other transaction in which the third party assumes control of all or part 22 of the business. 23 Sec. 45.48.880. Duty to maintain reasonable security measures. A business 24 that owns, licenses, or maintains a consumer's personal information shall implement 25 and maintain reasonable security procedures and practices appropriate to the nature of 26 the information to protect the personal information from unauthorized access, 27 destruction, use, modification, or disclosure. 28 Sec. 45.48.885. Component parts. If a series of steps or transactions are 29 component parts of a single transaction and are intended from the beginning to avoid 30 the reach of AS 45.48.800 - 45.48.945, including a business's disclosure of 31 34-LS1485\N HB 367 -20- HB0367a New Text Underlined [DELETED TEXT BRACKETED] information to a third party to avoid being considered a sale, the steps or transactions 1 may not be considered separate for the purposes of determining compliance with, an 2 exception to, or a violation of AS 45.48.800 - 45.48.945. 3 Sec. 45.48.890. Violations. (a) A violation of AS 45.48.800 - 45.48.945 is an 4 unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. Each day of a 5 violation constitutes a separate violation. 6 (b) In an action brought under AS 45.50.531(a), a consumer whose personal 7 information is subjected to unauthorized access, destruction, use, modification, or 8 disclosure has suffered an ascertainable loss of $1 or another amount proven at trial, 9 whichever is greater. 10 (c) The remedies under this section are in addition to the remedies provided 11 under AS 45.48.080 for a violation of AS 45.48.010 - 45.48.090. 12 Sec. 45.48.895. Consumer privacy account. (a) The consumer privacy 13 account is established as a separate account in the general fund. 14 (b) The consumer privacy account consists of 15 (1) money appropriated to the account by the legislature; 16 (2) the registration fees collected under AS 45.48.900(b)(2); 17 (3) the fees collected under AS 45.48.910; and 18 (4) civil penalties and money collected in or as a result of an action 19 brought by the attorney general under AS 45.48.800 - 45.48.945. 20 (c) The purposes of the consumer privacy account are to pay 21 (1) the salaries of attorneys in the Department of Law that enforce the 22 provisions of AS 45.48.800 - 45.48.945 at an amount that is competitive with the 23 private sector; and 24 (2) the administrative costs incurred by the department and the 25 Department of Law to enforce AS 45.48.800 - 45.48.945. 26 (d) The legislature may appropriate money deposited under (b)(2) - (4) of this 27 section for the purposes of the account. 28 Sec. 45.48.900. Data broker registration. (a) Before a business begins 29 operating as a data broker, the business shall register with the commissioner in 30 accordance with this section. 31 34-LS1485\N HB0367a -21- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (b) To register as a data broker, a business shall 1 (1) provide, on a form provided by the commissioner, 2 (A) the name of the data broker; 3 (B) the data broker's primary physical and mailing addresses; 4 (C) the data broker's electronic mailing address; 5 (D) the data broker's primary Internet website address; and 6 (E) the data broker's "Do Not Collect or Sell My Personal 7 Information" Internet website page as required under AS 45.48.800(c) or 8 alternative Internet website page that meets the requirements of 9 AS 45.48.800(d); and 10 (2) pay a registration fee in an amount established by the department 11 by regulation. 12 (c) The department shall deposit the fees paid under (b)(2) of this section into 13 the consumer privacy account established under AS 45.48.895. 14 Sec. 45.48.905. Data broker registry publicly displayed. The commissioner 15 shall make the information provided by data brokers under AS 45.48.900(b)(1) 16 available on the department's Internet website. 17 Sec. 45.48.910. Revenue fees. (a) A business that collects, sells, or shares 18 personal information from a consumer shall pay a fee to the department. The amount 19 of this fee is three percent of the revenue received by the business from the buying, 20 selling, or sharing of the personal information of a consumer or household 21 information. 22 (b) The department shall deposit the fees paid under (a) of this section into the 23 consumer privacy account established under AS 45.48.895. 24 Sec. 45.48.915. Regulations. (a) The attorney general shall adopt regulations 25 under AS 44.62 (Administrative Procedure Act) that 26 (1) create specific exceptions required to comply with state or federal 27 law; 28 (2) govern the Internet website page requirement of AS 45.48.800, 29 including 30 (A) the use of a recognizable and uniform mark to identify the 31 34-LS1485\N HB 367 -22- HB0367a New Text Underlined [DELETED TEXT BRACKETED] opportunity to exercise a right under AS 45.48.800 - 45.48.945; 1 (B) the submission of a consumer request; 2 (C) a business's compliance with a request under AS 45.48.835; 3 (3) update, as necessary, additional categories of personal information 4 required to be disclosed in response to relevant changes in technology, data collection 5 practices, privacy concerns, or obstacles to implementation; 6 (4) update, as necessary, the interpretation of unique identifiers in 7 response to relevant changes in technology, data collection practices, privacy 8 concerns, or obstacles to implementation; 9 (5) update, as necessary, the interpretation of designated methods for 10 submitting requests to facilitate a consumer's ability to obtain information from a 11 business; 12 (6) establish requirements to ensure that notices and information 13 provided under AS 45.48.800 are in plain language, accessible to consumers with 14 disabilities, and available in the language primarily used by the business to interact 15 with the consumer, including with regard to financial incentive offerings; 16 (7) designate the process for a consumer to authorize a representative 17 to exercise the rights provided under AS 45.48.800 - 45.48.945 on the consumer's 18 behalf; and 19 (8) further define the meaning of "profile." 20 (b) The attorney general may adopt regulations under AS 44.62 21 (Administrative Procedure Act) that 22 (1) establish rules and procedures for processing and complying with a 23 consumer request for specific pieces of personal information relating to a household to 24 address obstacles to implementation and privacy concerns; 25 (2) state that service providers may combine personal information for 26 specified purposes; 27 (3) are necessary to further the purposes of AS 45.48.800 - 45.48.945. 28 (c) The department shall establish by regulation adopted under AS 44.62 29 (Administrative Procedure Act) the amount of the registration fee that a data broker 30 shall pay under AS 45.48.900(b)(2). 31 34-LS1485\N HB0367a -23- HB 367 New Text Underlined [DELETED TEXT BRACKETED] Sec. 45.48.920. Persons who may consent. Except as provided in 1 AS 45.48.845(a), a person may provide consent for a consumer under AS 45.48.800 - 2 45.48.945 if the person is 3 (1) the consumer; 4 (2) the consumer's legal guardian; 5 (3) a person who holds a power of attorney for the consumer; or 6 (4) a person who is acting as a conservator for the consumer. 7 Sec. 45.48.925. Personnel training. A business subject to AS 45.48.800 - 8 45.48.945 shall provide training to individuals responsible for handling consumer 9 questions or requests under AS 45.48.800 - 45.48.945, including training the 10 individuals how to direct a consumer to exercise the consumer's rights under 11 AS 45.48.800 - 45.48.945. 12 Sec. 45.48.930. Provisions not waivable. A consumer's waiver of the 13 provisions of AS 45.48.800 - 45.48.945 is contrary to public policy and is 14 unenforceable and void. This section does not prevent a consumer from 15 (1) declining to request information from a business; 16 (2) declining to request that a business not collect, sell, or disclose the 17 consumer's personal information; or 18 (3) authorizing a business to sell the consumer's personal information 19 after previously requesting that the business not sell the personal information. 20 Sec. 45.48.935. Liberal construction. The intent of AS 45.48.800 - 45.48.945 21 is remedial and its provisions shall be liberally construed. 22 Sec. 45.48.940. Definitions. In AS 45.48.800 - 45.48.945, unless the context 23 indicates otherwise, 24 (1) "aggregated consumer information" means information that relates 25 to a group or category of consumers from which individual consumer identities have 26 been removed, and that is not linked or reasonably linkable by a device or other 27 method to a consumer or household; "aggregated consumer information" does not 28 mean an individual consumer record that has been de-identified; 29 (2) "application" means a computer software package that performs a 30 specific function; 31 34-LS1485\N HB 367 -24- HB0367a New Text Underlined [DELETED TEXT BRACKETED] (3) "beacon" means a small computer device that allows computer 1 information to be transmitted to a portable device that can connect to the Internet; 2 (4) "business" means a sole proprietorship, partnership, limited 3 liability company, corporation, association, or other legal entity that is organized or 4 operated for the profit or financial benefit of its shareholders, partners, members, or 5 other owners, that collects or has collected consumers' personal information or on the 6 behalf of which that information is collected, that alone or jointly with others 7 determines the purposes and means of processing personal information of consumers, 8 that does business in the state, and that 9 (A) satisfies one or both of the following thresholds: 10 (i) alone or in combination with another person, 11 annually buys, sells, or shares the personal information of 100,000 or 12 more consumers or households; or 13 (ii) derives 50 percent or more of its annual revenue 14 from selling or sharing the personal information of consumers; or 15 (B) controls or is controlled by a business that meets a 16 threshold in (A) of this paragraph and shares a name, service mark, trademark, 17 or other form of common branding with the business; in this subparagraph, 18 "control" means 19 (i) ownership or the power to vote more than 50 percent 20 of the outstanding shares of any class of voting security of a business; 21 (ii) control, in any manner, of the election of a majority 22 of the directors or of individuals exercising similar functions; or 23 (iii) the power to exercise a controlling influence over 24 the majority of the directors or of individuals exercising similar 25 functions; 26 (5) "business purpose" means a use for an operational purpose or other 27 notified purpose, if the use is reasonably necessary and proportionate to achieving the 28 operational purpose or other notified purpose for which personal information was 29 collected or processed, or is a compatible use; 30 (6) "categories of personal information" includes a category of 31 34-LS1485\N HB0367a -25- HB 367 New Text Underlined [DELETED TEXT BRACKETED] personal information set out in (24) of this section and a category of personal 1 information not specifically enumerated; 2 (7) "collect" includes buying, renting, gathering, obtaining, receiving, 3 or accessing personal information pertaining to a consumer by actively or passively 4 receiving information from the consumer, by observing the consumer's behavior, or by 5 any other means; 6 (8) "commercial purpose" includes marketing, advertising, and any 7 other purpose that advances a person's commercial or economic interests, except 8 engaging in political speech, journalism, or other speech that state or federal courts 9 have recognized as noncommercial speech; 10 (9) "commissioner" means the commissioner of commerce, 11 community, and economic development; 12 (10) "compatible use" means 13 (A) auditing related to a current interaction with the consumer 14 and counting the advertisement impressions made to individual visitors, 15 verifying positioning and quality of advertisement impressions, and auditing 16 compliance with this paragraph, other standards, and other concurrent 17 transactions; 18 (B) detecting security incidents, protecting against malicious, 19 deceptive, fraudulent, or illegal activity, and prosecuting those persons 20 responsible for that activity; 21 (C) identifying and removing errors from computer hardware 22 or software that impair existing intended functionality; 23 (D) the contextual customization of advertisements shown as 24 part of the same interaction and other short-term transient use, if the personal 25 information is not disclosed to a third party and is not used to build a profile 26 about a consumer or alter the experience of an individual consumer outside the 27 current interaction; 28 (E) maintaining or servicing accounts, providing customer 29 service, processing or fulfilling orders and transactions, verifying customer 30 information, processing payments, providing financing, providing advertising 31 34-LS1485\N HB 367 -26- HB0367a New Text Underlined [DELETED TEXT BRACKETED] or marketing services, providing analytical services, and performing other 1 services on behalf of the business or service provider; 2 (F) conducting internal research for technological development 3 and demonstration; 4 (G) performing activities to verify or maintain the quality or 5 safety of a service or device that is owned by, manufactured by, manufactured 6 for, or controlled by the business, and to improve, upgrade, or enhance the 7 service or device; or 8 (H) performing another use that is consistent with the context 9 in which the personal information was collected; 10 (11) "consent" 11 (A) means a consumer's freely given, specific, informed, and 12 unambiguous indication by statement, action, or other method, that the 13 consumer agrees to the processing of the consumer's personal information for a 14 narrowly defined purpose; 15 (B) does not mean 16 (i) acceptance of general terms of use, a broad statement 17 of terms of use, or a similar document that contains descriptions of 18 personal information processing along with other, unrelated 19 information; 20 (ii) hovering over, muting, pausing, or closing a given 21 piece of content on the Internet; or 22 (iii) an agreement obtained through the use of a user 23 interface designed or manipulated to subvert or impair user autonomy, 24 decision making, or choice; 25 (12) "conservator" has the meaning given in AS 13.06.050; 26 (13) "consumer" means an individual who is a resident of the state 27 under AS 01.10.055, whether identified by a unique identifier or other method of 28 identification, but does not mean an individual acting 29 (A) as an employee, owner, director, officer, member, or 30 contractor or in another capacity of a corporation, limited liability company, 31 34-LS1485\N HB0367a -27- HB 367 New Text Underlined [DELETED TEXT BRACKETED] sole proprietorship, partnership, association, nonprofit, or other entity or 1 government agency; 2 (B) for the entity or agency with another entity or agency; or 3 (C) in an employment context; 4 (14) "consumer request" means a request that is made by a consumer, 5 by a parent or legal guardian with legal custody of the consumer, or by a individual or 6 a person registered with the United States Secretary of State, authorized by the 7 consumer to act on the consumer's behalf; 8 (15) "data broker" means a business that knowingly collects and sells 9 to third parties the personal information of a consumer with whom the business does 10 not have a direct relationship, but does not include a consumer reporting agency to the 11 extent the agency is covered by 15 U.S.C. 1681 et seq. (Fair Credit Reporting Act); 12 (16) "de-identified" means that the information cannot reasonably 13 identify, relate to, describe, be capable of being associated with, or be directly or 14 indirectly linked to, an individual consumer, and the business holding the information 15 (A) has implemented technical safeguards that prohibit re- 16 identification of the consumer to whom the information may pertain; 17 (B) has implemented business processes that specifically 18 prohibit re-identification of the information; 19 (C) has implemented business processes to prevent inadvertent 20 release of de-identified information; and 21 (D) makes no attempt to re-identify the information; 22 (17) "department" means the Department of Commerce, Community, 23 and Economic Development; 24 (18) "device" includes a computer and a physical object that can 25 (A) read, write, or store information that is represented in 26 numerical form; 27 (B) connect to the Internet, directly or indirectly, or to another 28 device; 29 (19) "disclose" includes all types of disclosure, including the 30 disclosure of personal information related to a sale of personal information; 31 34-LS1485\N HB 367 -28- HB0367a New Text Underlined [DELETED TEXT BRACKETED] (20) "Internet website page" means a document accessible through the 1 Internet with a unique identifier used to locate a resource on the Internet; 2 (21) "knowingly" has the meaning given in AS 11.81.900(a); 3 (22) "operational purpose" means the use of personal information, 4 when reasonably necessary and proportionate, to achieve, if the use is limited to a 5 direct relationship and experience with a consumer, 6 (A) debugging to identify and repair errors that impair existing 7 intended functions; 8 (B) based on information collected by the business, 9 undertaking internal research for analysis, product improvement, and 10 technology development; 11 (C) verification or maintenance of the quality or safety of a 12 service or device that is owned, manufactured, manufactured for, or controlled 13 by the business, or to improve, upgrade, or enhance a service or device that is 14 owned, manufactured, manufactured for, or controlled by the business; 15 (D) customization of content based on information collected by 16 the business; or 17 (E) customization of advertising or marketing based on 18 information collected by the business; 19 (23) "person" means an individual, proprietorship, corporation, 20 company, partnership, firm, association, and any other nongovernmental organization 21 or group of persons acting in concert; 22 (24) "personal information" 23 (A) means the information in the following categories that 24 identifies, relates to, describes, is reasonably capable of being associated with, 25 or could reasonably be linked, directly or indirectly, with a particular consumer 26 or household: 27 (i) a real name, alias, postal address, unique identifier, 28 online identifier, Internet protocol address, electronic mail address, 29 account name, or other identifier; 30 (ii) signature; 31 34-LS1485\N HB0367a -29- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (iii) physical characteristics or physical description; 1 (iv) telephone number; 2 (v) insurance policy number; 3 (vi) characteristics of protected classifications under 4 state or federal law; 5 (vii) commercial information, including bank accounts, 6 records of personal property, products or services purchased, obtained, 7 or considered, or other purchasing or consuming histories or 8 tendencies; 9 (viii) browsing history, search history, and information 10 regarding a consumer's interaction with an Internet website, 11 application, or advertisement, or other Internet or electronic network 12 activity information; 13 (ix) geolocation data, including precise geolocation 14 data; 15 (x) audio, electronic, visual, thermal, olfactory, or 16 similar information; 17 (xi) professional or employment-related information; 18 (xii) information that is personally identifiable 19 information, as defined in 34 C.F.R. 99.3, that is not publicly available; 20 (xiii) sensitive personal information; 21 (xiv) inferences drawn from any of the information 22 identified in this subparagraph to create a profile about a consumer 23 reflecting the consumer's preferences, characteristics, psychological 24 trends, predispositions, behavior, attitudes, intelligence, abilities, and 25 aptitudes; 26 (B) does not mean 27 (i) publicly available information; 28 (ii) consumer information that is de-identified or is 29 aggregated consumer information; 30 (iii) biometric information; in this sub-subparagraph, 31 34-LS1485\N HB 367 -30- HB0367a New Text Underlined [DELETED TEXT BRACKETED] "biometric information" means an individual's physiological, 1 biological, or behavioral characteristics that can be used to establish 2 individual identity; 3 (25) "precise geolocation data" 4 (A) means data that is derived from a consumer device through 5 a technology that 6 (i) is capable of determining with specificity the latitude 7 and longitude coordinates or other spatial location of a person or 8 device; 9 (ii) has an accuracy level of less than 1,750 feet; 10 (iii) uses a global positioning system, a triangulated 11 location provided by a beacon, network radios, or a technology that 12 allows computers, mobile phones, or other devices to connect to the 13 Internet or communicate with one another wirelessly within a particular 14 area, or another technology; 15 (B) does not mean information that is or will be 16 (i) altered before the information is processed, in order 17 to be able to determine with specificity the physical location of an 18 individual or device; 19 (ii) used by a business when acting as an employer; 20 (26) "processing" means any operation or set of operations performed 21 on personal data or on sets of personal data, whether or not by automated means; 22 (27) "profile" or "profiling" means automated processing of personal 23 information, as further defined by regulation adopted under AS 45.48.915, to analyze 24 or predict an individual's work performance, economic situation, health, personal 25 preferences, interests, reliability, behavior, location, movements, or other personal 26 features; 27 (28) "publicly available information" means information that is 28 lawfully made available from federal, state, or local government records, that a 29 business has a reasonable basis to believe is lawfully made available to the general 30 public by the consumer or from widely distributed media, or that a consumer makes 31 34-LS1485\N HB0367a -31- HB 367 New Text Underlined [DELETED TEXT BRACKETED] available by a person to whom the consumer has disclosed the information if the 1 consumer has not restricted the information to a specific audience; 2 (29) "research" means scientific systematic study and observation that 3 is in the public interest, that adheres to all applicable ethics and privacy laws, and 4 (A) is compatible with the business purpose for which the 5 personal information was collected; 6 (B) is used solely for research purposes that are compatible 7 with the context in which the personal information was collected; 8 (C) is not used for a commercial purpose; and 9 (D) in which the personal information is 10 (i) later pseudonymized and de-identified, or de- 11 identified and in the aggregate, if the information cannot reasonably 12 identify, relate to, describe, be capable of being associated with, or be 13 linked, directly or indirectly, to a particular consumer; personal 14 information is considered pseudonymized if the information is 15 processed so that it is no longer attributable to a specific consumer 16 without the use of additional information, and the additional 17 information is kept separate and is subject to technical and 18 organizational measures to ensure that the personal information is not 19 attributed to an identified or identifiable consumer; 20 (ii) subject to technical safeguards that prohibit re- 21 identification of the consumer to whom the information may pertain; 22 (iii) subject to business processes that specifically 23 prohibit re-identification of the information; 24 (iv) subject to business processes to prevent inadvertent 25 release of de-identified information; and 26 (v) subjected by the business conducting the research to 27 additional security controls that limit access to the research data to 28 individuals in the business as necessary to carry out the research 29 purpose; 30 (30) "sale," "sell," or "sold" means renting, releasing, disclosing, 31 34-LS1485\N HB 367 -32- HB0367a New Text Underlined [DELETED TEXT BRACKETED] disseminating, making available, transferring, or otherwise communicating orally, in 1 writing, or by electronic or other means, a consumer's personal information by a 2 business to a third party for monetary or other valuable consideration or for another 3 commercial purpose; 4 (31) "sensitive personal information" means information that is not 5 publicly available information and reveals 6 (A) a consumer's social security number, driver's license 7 number, known traveler number, state identification card number, passport 8 number, or other unique identification number issued on a government 9 document commonly used to verify the identity of a specific individual; 10 (B) the number of a consumer's Internet account, financial 11 account, debit card account, credit card account, or other account, in 12 combination with any required security or access code, password, or 13 credentials allowing access to the account; 14 (C) a consumer's precise geolocation; 15 (D) a consumer's racial or ethnic origin, religious or 16 philosophical beliefs, mental or physical health diagnosis, sexual orientation, 17 citizenship or immigration status, or union membership; 18 (E) the contents of a consumer's mail or electronic mail, text 19 message, or other electronic communication, unless the business possessing the 20 information is the intended recipient of the communication; 21 (F) a consumer's genetic data; 22 (G) information about an individual who is less than 18 years 23 of age; 24 (H) information collected and analyzed concerning a 25 consumer's health; or 26 (I) information collected and analyzed about a consumer's 27 sexual life or sexual orientation; 28 (32) "service provider" means a person that receives personal 29 information from a business to be used solely for a business purpose under a written 30 contract that requires the service provider to comply with AS 45.48.860; 31 34-LS1485\N HB0367a -33- HB 367 New Text Underlined [DELETED TEXT BRACKETED] (33) "share" means renting, releasing, disclosing, disseminating, 1 making available, transferring, or otherwise communicating orally, in writing, or by 2 electronic or other means personal information by a business to a third party for 3 cross‐context behavioral advertising, whether for monetary or other valuable 4 consideration, or in a transaction between a business and a third party for 5 cross‐context behavioral advertising for the benefit of a business in which no money is 6 exchanged; in this paragraph, "cross-context behavioral advertising" means the 7 targeting of advertising to a consumer based on the consumer's personal information 8 obtained from the consumer's activity across businesses, distinctly branded Internet 9 websites, applications, or services, other than the business, distinctly branded website, 10 application, or service with which the consumer intentionally interacts; 11 (34) "third party" means any person, except 12 (A) the business that collected the personal information from 13 the consumer; and 14 (B) a service provider contracting with the business that 15 collected the personal information from the consumer; 16 (35) "unique identifier" includes a device identifier; an Internet 17 protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar 18 technology; customer number, unique pseudonym, or user alias; telephone numbers, or 19 other forms of persistent or probabilistic identifiers that can be used to identify a 20 particular consumer or device; or another persistent identifier that can be used to 21 recognize a consumer, a household, or a device that is linked to a consumer or 22 household, over time and across different services; in this paragraph, 23 (A) "cookie" means information from an Internet website 24 stored by a person's computer that is used to identify the person's computer 25 while the person is using the website; 26 (B) "pixel tag" means a small design or picture that is loaded 27 when a computer user visits an Internet website page or opens electronic mail; 28 (C) "probabilistic identifier" means the identification of a 29 consumer or a device to a degree of certainty of more probable than not based 30 on a category of personal information included in, or similar to, the categories 31 34-LS1485\N HB 367 -34- HB0367a New Text Underlined [DELETED TEXT BRACKETED] of personal information. 1 Sec. 45.48.945. Short title. AS 45.48.800 - 45.48.945 may be cited as the 2 Consumer Personal Information Privacy Act. 3 * Sec. 5. AS 45.50.471(b) is amended by adding a new paragraph to read: 4 (58) violating AS 45.48.800 - 45.48.945 (Consumer Personal 5 Information Privacy Act). 6 * Sec. 6. The uncodified law of the State of Alaska is amended by adding a new section to 7 read: 8 APPLICABILITY: CONTRACTS. This Act applies to a contract entered into on or 9 after the effective date of secs. 1 - 6 of this Act. 10 * Sec. 7. The uncodified law of the State of Alaska is amended by adding a new section to 11 read: 12 TRANSITION: REGULATIONS. The attorney general shall adopt regulations as 13 authorized under AS 45.48.915, added by sec. 4 of this Act, to implement the changes made 14 by this Act. The regulations take effect under AS 44.62 (Administrative Procedure Act), but 15 not before the effective date of the law implemented by the regulation. 16 * Sec. 8. Section 7 of this Act takes effect immediately under AS 01.10.070(c). 17 * Sec. 9. Except as provided in sec. 8 of this Act, this Act takes effect January 1, 2027. 18