,i #aai? ,,congress #b;d ,session ,h4 ,r4 #hdac ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,april #ba1 #bjbf,mr4 ,joyce ( ,p5nsylvania 7= himself1 ,mr4 ,fry1 ,mr4 ,kean1 ,mr4 ,ob]nolte1 ,mr4 ,langwor?y1 ,mr4 ,goldman ( ,texas1 ,mr4 ,griffi?1 ,mr4 ,bald]son1 & ,mrs4 ,f$or*ak7 introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,en]gy & ,comm]ce1 & 9 addition to ! ,committee on ! ,judici>y1 = a p]iod to be subsequ5tly det]m9$ by ! ,speak]1 9 ea* case = consid]ation ( su* provisions z fall )9 ! jurisdiction ( ! committee conc]n$ ,a ,,bill ,to e/abli% a national framework = consum] privacy rights & ! protection ( p]sonal data1 & = o!r purposes4 #a4 ,%ort title 7a7 ,%ort title ,?is ,act may be cit$ z ! ,secur+ & ,e/abli%+ ,consum] ,uni=m ,rights & ,en=cem5t ov] ,data ,act or ! ,,secure ,data ,act4 7b7 ,table ( cont5ts ,! table ( cont5ts = ! ,act is z foll[s3 ,sec4 #a4 ,%ort title4 ,sec4 #b4 ,consum] privacy rights4 ,sec4 #c4 ,controll]s4 ,sec4 #d4 ,data security4 ,sec4 #e4 ,data brok]s4 ,sec4 #f4 ,processors4 ,sec4 #g4 ,deid5tifi$ & pseudonym\s data4 ,sec4 #h4 ,codes ( conduct4 ,sec4 #i4 ,cross-bord] data fl[s4 ,sec4 #aj4 ,/udy on univ]sal opt-out me*anisms4 ,sec4 #aa4 ,rules ( con/ruction4 ,sec4 #ab4 ,en=cem5t4 ,sec4 #ac4 ,applicability4 ,sec4 #ad4 ,relation%ip to ,f$]al laws4 ,sec4 #ae4 ,relation%ip to ,/ate laws4 ,sec4 #af4 ,def9itions4 ,sec4 #ag4 ,sev]ability4 ,sec4 #ah4 ,effective dates4 #b4 ,consum] privacy rights 7a7 ,consum] privacy rights ,a consum] has ! foll[+ privacy rights ) respect to a controll]3 7#a7 ,to confirm :e!r a controll] is process+ ! p]sonal data ( ! consum] & h access to a copy ( su* data1 unless ! confirmation & access w\ld require ! controll] to reveal a trade secret4 7#b7 ,to correct any inaccuracy 9 ! p]sonal data ( ! consum]1 tak+ into acc\nt ! nature ( ! p]sonal data & ! purpose ( process+ ! p]sonal data4 7#c7 ,to delete p]sonal data provid$ by or obta9$ ab\t ! consum]4 7#d7 ,if ! data is available 9 a digital =mat & to ! ext5t te*nically feasible1 to obta9 a copy ( ! p]sonal data t ! consum] previ\sly provid$ to ! controll] 9 a portable & readily usable =mat t all[s ! consum] to transmit ! data to ano!r controll] )\t h9drance4 7#e7 ,to opt out ( ! process+ ( ! p]sonal data = ! foll[+ purposes3 7,a7 ,t>get$ adv]tis+4 7,b7 ,! sale ( p]sonal data4 7,c7 ,reliance on pr(il+ to make a decision t has a legal or simil>ly significant effect on ! consum]4 7b7 ,cons5t requir$ = process+ s5sitive data 7#a7 ,9 g5]al ,except z provid$ 9 p>agraphs 7#b7 & 7#c71 a controll] may n process ! s5sitive data ( a consum] )\t obta9+ ! cons5t ( ! consum] be=e process+4 7#b7 ,applicability to a *ild ,not)/&+ p>agraph 7#a71 a controll] %all process ! s5sitive data ( a *ild 9 accordance ) ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq74 7#c7 ,applicability to a te5 ,not)/&+ p>agraph 7#a71 a controll] may n process ! s5sitive data ( a te5 )\t obta9+ ! v]ifiable cons5t ( a p>5t ( ! te54 7c7 ,consum] privacy rights reque/s 7#a7 ,reque/ = consum] rights ,a controll] %all comply ) any consum] privacy "r describ$ 9 subsection 7a7 once a consum] submits a reque/ t specifies ea* consum] privacy "r ! consum] reque/s to ex]cise & ! controll] au!nticates ! consum]4 7#b7 ,*ild & te5 consum] rights ,) respect to a consum] privacy "r describ$ 9 subsection 7a7 = a *ild or te51 only a p>5t ( ! *ild or te5 may ex]cise su* consum] privacy "r on behalf ( ! *ild or te54 7d7 ,controll] requirem5ts 7#a7 ,deadl9e = response ,except z provid$ 9 p>agraph 7#b71 )\t undue delay & n lat] ?an #de days aft] ! date on :i* a consum] submits a reque/ "u subsection 7c71 a controll]-- 7,a7 %all respond to ! consum] & comply ) ea* privacy "r reque/$2 or 7,b7 %all provide a notice to ! consum] t-- 7i7 ! controll] decl9es to take action2 7ii7 includes a ju/ification = su* inaction2 & 7iii7 includes in/ructions on h[ ! consum] c appeal ! decision ( su* inaction4 7#b7 ,ext5sion ( response p]iod ,! controll] may ext5d ! p]iod describ$ 9 p>agraph 7#a77;,a7 an additional #de days :5 reasonably necess>y1 tak+ into consid]ation ! complexity & numb] ( reque/s submitt$ by ! consum]1 if ! controll] in=ms ! consum] ( ! ext5sion dur+ su* p]iod ) ! reason = su* ext5sion4 7#c7 ,fees *>g$ 7,a7 ,free ( *>ge ,= ea* consum] privacy "r describ$ 9 subsection 7a71 a consum] may submit to ea* controll] #b reque/s "u subsection 7c7 relat$ to su* consum] privacy "r 9 a ye> free ( *>ge4 7,b7 ,reasonable fee = adm9i/rative co/ ,if a consum] submits m ?an #b su* reque/s or submits a reque/ t is te*nically infeasible or manife/ly unf\nd$1 ! controll] may-- 7i7 *>ge ! consum] a reasonable fee to cov] ! adm9i/rative co/s ( comply+ ) ! reque/ if ! controll] has notifi$ ! consum] ( su* fee & ! consum] has cons5t$ to pay su* fee2 or 7ii7 decl9e to act on ! reque/4 7,c7 ,controll] docum5tation requir$ ,! controll] %all demon/rate1 docum5t1 & provide to ! ,commission or a ,/ate attorney g5]al1 ^u reque/1 any te*nically infeasible or manife/ly unf\nd$ nature ( any su* reque/4 7#d7 ,au!ntication ,if a controll] is unable to au!nticate a consum] :o submits a reque/ "u subsection 7c71 ! controll] is n requir$ to comply ) su* reque/ & may reque/ t ! consum] provide additional in=mation reasonably necess>y to au!nticate ! consum] & ! reque/4 7#e7 ,p]sonal data obta9$ f ?ird p>ty ,a controll] t obta9s p]sonal data ab\t a consum] f a s\rce o!r ?an ! consum] is consid]$ to be 9 compliance ) ! reque/ ( a consum] "u subsection 7c7 to delete t p]sonal data "u subsection 7a77#c7 by-- 7,a7 reta9+ a record ( ! deletion reque/ & ! m9imum data necess>y = ! purpose ( ensur+ ! p]sonal data ( ! consum] rema9s delet$ f ! records ( ! controll] & n us+ ! reta9$ data = any o!r purpose "u ?is ,act2 or 7,b7 opt+ ! consum] out ( ! process+ ( t p]sonal data = any purpose o!r ?an a purpose t is exempt "u ! provisions ( ?is ,act4 7#f7 ,applicability to a *ild ,) respect to a reque/ ( a consum] "u subsection 7c7 = a *ild1 a controll] %all be deem$ to be 9 compliance ) su* subsection if ! controll] responds to an equival5t consum] privacy "r ex]cis$ by a p>5t "u ! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq74 7e7 ,appeal process 7#a7 ,e/abli%m5t ( process ,a controll] %all e/abli% a process = a consum] to appeal a det]m9ation by ! controll] to n take action "u subsection 7d77#a77;,b74 7#b7 ,availability ,! appeal process e/abli%$ pursuant to p>agraph 7#a7 %all be conspicu\sly available & simil> to ! process = a reque/ submitt$ "u subsection 7c74 7#c7 ,deadl9e to respond ,n lat] ?an #fj days aft] ! date on :i* an appeal is receiv$ by a controll]1 ! controll]-- 7,a7 %all in=m ! consum] 9 writ+ ( any action tak5 or n tak5 9 response to ! appeal1 includ+ a writt5 explanation ( ea* reason = a decision2 & 7,b7 if ! appeal is d5i$1 %all provide ! consum] ) an onl9e me*anism1 if available1 or o!r me?od ?r\gh :i* ! consum] may contact ! ,commission or a ,/ate attorney g5]al to submit a compla9t4 7f7 ,ex]cis+ consum] rights 7#a7 ,submission ( reque/s ,a controll] %all e/abli% & describe 9 a privacy notice "o or m secure & reliable means = a consum] to submit a reque/ to ex]cise consum] privacy rights describ$ "u subsection 7a74 7#b7 ,consid]ations ,9 e/abli%+ ! means pursuant to p>agraph 7#a71 a controll] %all take into acc\nt ! ways 9 :i* a consum] normally int]acts ) ! controll]1 ! ne$ = secure & reliable communication ( su* reque/s1 & ! ability ( ! controll] to au!nticate ! consum] mak+ ! reque/4 7#c7 ,new acc\nts n requir$ ,a controll] may n require a consum] to create a new acc\nt 9 ord] to ex]cise consum] privacy rights describ$ "u subsection 7a7 b may require a consum] to use an exi/+ acc\nt4 #c4 ,controll]s 7a7 ,data m9imization ,a controll] %all limit ! collection ( p]sonal data to :at is adequate1 relevant1 & reasonably necess>y 9 relation to ea* purpose = :i* ! data is process$ z disclos$ to ! consum]4 7b7 ,limitation on second>y uses ,except z o!rwise provid$ 9 ?is section1 a controll] may n process p]sonal data = any purpose t is n reasonably necess>y or compatible ) ! disclos$ purpose = :i* ! p]sonal data is process$ z disclos$ to ! consum]1 unless ! controll] obta9s ! cons5t ( ! consum] be=e any su* process+4 7c7 ,civil rights ,a controll] may n process p]sonal data 9 violation ( a ,f$]al law t prohibits unlawful discrim9ation aga9/ a consum]4 7d7 ,non-,discrim9ation ,a controll] may n discrim9ate aga9/ a consum] = ex]cis+ any consum] "r describ$ "u section #b1 includ+ by d5y+ goods or s]vices1 *>g+ diff]5t prices or rates = goods or s]vices1 or provid+ a diff]5t level ( quality ( goods & s]vices to ! consum]4 7e7 ,consum] loyalty programs ,no?+ 9 subsection 7d7 may be con/ru$-- 7#a7 to require a controll] to provide a product or s]vice t requires ! p]sonal data ( a consum] t ! controll] does n collect or ma9ta92 or 7#b7 to prohibit a controll] f (f]+ a diff]5t price1 rate1 level1 quality1 or selection ( goods or s]vices to a consum]1 includ+ (f]+ goods or s]vices = no fee1 if ! (f] is relat$ to ! volunt>y p>ticipation ( a consum] 9 a bona fide loyalty1 rew>ds1 premium features1 disc\nts1 or club c>d program4 7f7 ,non-,waiv] ( consum] rights ,beg9n+ on ! date ( ! enactm5t ( ?is ,act1 any provision ( a contract or agreem5t ( any k9d t waives or limits a consum] "r describ$ "u section #b %all be deem$ contr>y to public policy & %all be void & un5=ceable4 7g7 ,notice to consum]s ,be=e process+ ! p]sonal data ( a consum]1 a controll] %all provide t consum] ) a reasonably accessible1 cle>1 & mean+ful privacy notice t includes ! foll[+3 7#a7 ,ea* category ( p]sonal data process$ by ! controll]4 7#b7 ,ea* purpose = process+ p]sonal data4 7#c7 ,h[ a consum] may ex]cise a consum] "r describ$ "u section #b1 includ+ h[ a consum] may appeal ! decision ( a controll] "u section #b7;d74 7#d7 ,ea* category ( p]sonal data ! controll] %>es ) any o!r controll] or any gov]nm5tal entity4 7#e7 ,ea* category ( o!r controll]s or any gov]nm5tal entity1 if any1 ) :om ! controll] %>es p]sonal data4 7#f7 ,:e!r any p]sonal data process$ by ! controll] is transf]r$ to1 process$ 91 /or$ 91 or sold to a cov]$ nation4 7h7 ,disclosure ( sale ,if a controll] sells p]sonal data ( a consum]1 ! controll] %all cle>ly & conspicu\sly disclose-- 7#a7 su* activity be=e any collection or sale ( p]sonal data2 & 7#b7 ! mann] 9 :i* a consum] may ex]cise ! "r to opt out ( ! sale ( su* p]sonal data "u section #b7;a77#e74 7i7 ,disclosure ( t>get$ adv]tis+ ,if a controll] processes p]sonal data ( a consum] = t>get$ adv]tis+1 ! controll] %all cle>ly & conspicu\sly disclose-- 7#a7 su* activity be=e any collection or use ( p]sonal data2 & 7#b7 ! mann] 9 :i* a consum] may ex]cise ! "r to opt out ( su* process+ "u section #b7;a77#e74 7j7 ,automat$ decision mak+ 7#a7 ,pr(il+ ,a controll] t relies on pr(il+ to make a decision t has a legal or simil>ly significant effect on a consum] %all cle>ly & conspicu\sly disclose to su* consum] be=e any su* decision is made t-- 7,a7 ! decision w be made us+ automat$ means2 & 7,b7 ! mann] 9 :i* a consum] may ex]cise ! "r to opt out ( su* pr(il+4 7#b7 ,reliance on pr(il+ ,= purposes ( p>agraph 7#a7 & section #b7;a77#e71 a controll] relies on pr(il+ to make a decision t has a legal or simil>ly significant effect on a consum] if su* decision is made ) no human review1 involvem5t1 ov]sight1 or int]v5tion4 #d4 ,data security 7a7 ,data security ,a controll] %all e/abli%1 implem5t1 & ma9ta9 reasonable adm9i/rative1 te*nical1 & physical data security practices to protect ! confid5tiality1 integrity1 & accessibility ( p]sonal data & t are appropriate to ! volume1 s5sitivity1 & nature ( su* p]sonal data4 7b7 ,rebuttable presumption ,a controll] has a rebuttable presumption to an alleg$ violation ( ?is section if-- 7#a7 ! controll] complies ) a relevant code ( conduct approv$ "u section #h7;a77#c7 7or a relevant c]tification describ$ 9 section #h7;f772 or 7#b7 ! controll] has e/abli%$1 implem5t$1 & ma9ta9$-- 7,a7 data security practices appropriate to ! /ate-(-!-art 9 adm9i/rative1 te*nical1 & physical data security practices = ! protection ( ! confid5tiality1 integrity1 & accessibility ( p]sonal data1 includ+ su* a practice demon/rat$ by adh]5ce to a widely accept$ te*nical specification or ?r\gh a ?ird-p>ty atte/ation2 & 7,b7 a compreh5sive data security program t reasonably con=ms to a relevant ,f$]al or widely accept$ int]national risk managem5t framework = id5tify+ & protect+ aga9/ data security risks1 & = detect+1 respond+ to1 & recov]+ f data security ev5ts4 #e4 ,data brok]s 7a7 ,disclosure ,a data brok] %all po/ on a publicly available website or mobile application a conspicu\s notice t-- 7#a7 /ates t ! entity ma9ta9+ ! website or application is a data brok]2 7#b7 is cle>1 n mislead+1 & readily accessible by ! public2 & 7#c7 in=ms a consum] h[ to ex]cise any consum] "r describ$ "u section #b4 7b7 ,regi/ration ,n lat] ?an #ab mon?s aft] ! date ( ! enactm5t ( ?is ,act1 & annually !reaft]1 a data brok] %all regi/] ) ! ,commission by fil+ a regi/ration /atem5t & pay+ a reasonable regi/ration fee set by ! ,commission t includes ! foll[+ in=mation3 7#a7 ,! legal "n ( ! data brok]4 7#b7 ,a contact p]son & ! prim>y physical address1 email address1 telephone numb]1 & website address = ! data brok]4 7#c7 ,a description ( ea* category ( p]sonal data sold by ! data brok]4 7#d7 ,a /atem5t ( :e!r ! data brok] implem5ts a pur*as] cr$5tial+ process4 7#e7 ,a description ( any incid5t ( unau?oriz$ access to p]sonal data t ! data brok] has report$ to a ,f$]al or ,/ate gov]nm5tal entity pursuant to an applicable law1 rule1 or regulation dur+ ! ye> be=e ! ye> 9 :i* ! regi/ration is fil$1 & if kn[n1 ! total numb] ( consum]s affect$ by ea* previ\sly report$ incid5t ( su* unau?oriz$ access4 7#f7 ,a l9k to ! privacy policy publi%$ 9 accordance ) section #c7;g74 7#g7 ,a l9k to a website publi%$ by ! data brok] t in=ms a consum] h[ to ex]cise any consum] "r describ$ "u section #b4 7c7 ,data brok] regi/ry ,n lat] ?an #ah mon?s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,commission %all e/abli% & ma9ta9 on a publicly available website ( ! ,commission a se>*able1 c5tral regi/ry ( data brok]s regi/]$ "u subsection 7b7 t includes ! foll[+3 7#a7 ,a se>* feature t all[s a p]son se>*+ ! regi/ry to id5tify a data brok]4 7#b7 ,= ea* data brok]1 a l9k to ! privacy policy publi%$ 9 accordance ) section #c7;g74 7#c7 ,= ea* data brok]1 a l9k to a website publi%$ by ! data brok] t in=ms a consum] h[ to ex]cise any consum] "r describ$ "u section #b4 #f4 ,processors 7a7 ,adh]5ce to controll] in/ructions ,a processor %all adh]e to ! in/ructions ( a controll] & %all assi/ ! controll] 9 meet+ ! requirem5ts ( ?is ,act1 includ+ by tak+ into acc\nt ! nature ( process+ & ! in=mation available to ! processor-- 7#a7 by appropriate adm9i/rative & te*nical measures1 ins(> z reasonably practicable1 to fulfill ! requirem5ts ( ! controll] to respond to an ass]tion ( any consum] "r describ$ "u section #b2 & 7#b7 by assi/+ ! controll] 9 meet+ ! requirem5ts ( ! controll] "u section #d4 7b7 ,contractual obligation ,a contract betwe5 a controll] & a processor %all gov]n ! data process+ proc$ures ( ! processor ) respect to process+ p]=m$ on behalf ( ! controll]4 ,! contract %all cle>ly set =? in/ructions = process+ p]sonal data1 ! nature & purpose ( process+1 ! type ( p]sonal data subject to process+1 ! duration ( process+1 & ! rights & obligations ( bo? p>ties4 7c7 ,m9imum requirem5ts ,at a m9imum1 ! contract betwe5 a controll] & processor %all include requirem5ts t ! processor does ! foll[+3 7#a7 ,ensures t ea* p]son process+ p]sonal data is subject to a duty ( confid5tiality ) respect to ! data4 7#b7 ,at ! direction ( ! controll]1 deletes or returns all p]sonal data to ! controll] z reque/$ at ! end ( ! provision ( s]vices1 unless ret5tion ( ! p]sonal data is requir$ by law4 7#c7 ,^u ! reasonable reque/ ( ! controll]1 makes available to ! controll] all in=mation 9 ! possession ( ! processor necess>y to demon/rate compliance by ! processor ) ! requirem5ts ( ?is ,act4 7#d7 ,ei!r-- 7,a7 all[s & coop]ates ) reasonable assessm5ts by ! controll] or a designat$ assessor by ! controll]2 or 7,b7 ! processor-- 7i7 arranges = a qualifi$ & indep5d5t assessor to conduct an assessm5t ( ! policies & adm9i/rative & te*nical measures ( su* processor t meet ! requirem5ts ( ?is ,act us+ an appropriate & accept$ control /&>d or framework & assessm5t proc$ure = su* assessm5t2 & 7ii7 provides a report ( ! assessm5t to ! controll] ^u reque/4 7#e7 ,if a processor engages a subcontractor1 include 9 any subcontract a requirem5t t ! subcontractor meet ! obligations ( ! processor ) respect to ! p]sonal data4 7d7 ,rule ( con/ruction ,no?+ 9 ?is section may be con/ru$ to relieve a controll] or processor f any liability impos$ on ! controll] or processor by virtue ( a role 9 a process+4 7e7 ,applicability 7#a7 ,controll] or processor ,! det]m9ation ab\t :e!r a p]son is act+ z a controll] or processor ) respect to a specific process+ ( p]sonal data is a fact-bas$ det]m9ation t dep5ds ^u ! context 9 :i* p]sonal data is to be process$4 7#b7 ,controll] ,if a processor1 alone or jo9tly ) o!rs1 beg9s det]m9+ ! purpose & means ( process+ p]sonal data1 su* processor is a controll] ) respect to a specific process+ ( su* p]sonal data4 7#c7 ,processor ,a processor t foll[s ! in/ructions ( a controll] ) respect to a specific process+ ( p]sonal data rema9s a processor4 #g4 ,deid5tifi$ & pseudonym\s data 7a7 ,9 g5]al ,a controll] 9 possession ( deid5tifi$ data %all-- 7#a7 take reasonable measures to ensure ! data _c be associat$ ) an individual2 7#b7 publicly commit to ma9ta9 & use deid5tifi$ data )\t attempt+ to re-id5tify ! data2 & 7#c7 contractually obligate any recipi5t ( ! deid5tifi$ data to comply ) ea* requirem5t ( ?is ,act4 7b7 ,ongo+ compliance ,a controll] t discloses deid5tifi$ or pseudonym\s data %all ex]cise reasonable ov]sight to monitor compliance ) any contractual commitm5t to :i* ! deid5tifi$ or pseudonym\s data is subject & %all take appropriate /eps to address any brea* ( su* contractual commitm5t4 7c7 ,pseudonym\s data ,an ass]tion ( any consum] "r describ$ "u section #b does n apply to pseudonym\s data = a case 9 :i* ! controll] is able to demon/rate any in=mation necess>y to id5tify ! consum] is kept sep>ately & is subject to appropriate adm9i/rative & te*nical measures to ensure t ! p]sonal data is n attribut$ to an id5tifi$ or id5tifiable natural p]son4 7d7 ,rule ( con/ruction relat+ to deid5tifi$ or pseudonym\s data ,no?+ 9 ?is ,act may be con/ru$ to require a controll] or processor to-- 7#a7 re-id5tify deid5tifi$ data or pseudonym\s data2 or 7#b7 ma9ta9 data 9 id5tifiable =m1 or collect1 obta91 reta91 or access any data or te*nology1 9 ord] to be capable ( associat+ a consum] reque/ ) p]sonal data4 7e7 ,rule ( con/ruction relat+ to consum] rights reque/s ,no?+ 9 ?is ,act may be con/ru$ to require a controll] or processor to comply ) an ass]tion ( any consum] "r describ$ "u section #b if-- 7#a7 ! controll] is n reasonably capable ( associat+ ! reque/ ) ! p]sonal data or x w\ld be unduly burd5some = ! controll] to associate ! reque/ ) ! p]sonal data2 7#b7 ! controll] does n use ! p]sonal data to recognize or respond to ! specific consum] :o is ! subject ( ! p]sonal data1 or associate ! p]sonal data ) o!r p]sonal data ab\t ! same specific consum]2 & 7#c7 ! controll] does n sell ! p]sonal data to ano!r controll] or o!rwise volunt>ily disclose ! p]sonal data to any entity o!r ?an a processor1 except z o!rwise p]mitt$ 9 ?is section4 #h4 ,codes ( conduct 7a7 ,application = approval ( code ( conduct 7#a7 ,9 g5]al ,a controll] or processor 7or a gr\p ( controll]s or processors7 may submit to ! ,secret>y an application = approval ( a code ( conduct t meets or exce$s ! requirem5ts ( ! controll] or processor 7or ! gr\p ( controll]s or processors7 "u ?is ,act4 7#b7 ,application requirem5ts ,an application submitt$ "u p>agraph 7#a7 %all include ! foll[+3 7,a7 ,a description ( ! specific requirem5ts ( ?is ,act to :i* ! code ( conduct propos$ 9 ! application w apply4 7,b7 ,a description ( h[ ! code ( conduct w meet or exce$ su* requirem5ts4 7,c7 ,a description ( ! entities ! code ( conduct is design$ to cov]4 7,d7 ,a li/ ( ! controll]s or processors1 to ! ext5t kn[n at ! "t ( application1 t int5d to comply ) ! code ( conduct4 7,e7 ,a description ( ! indep5d5t organization t w adm9i/] ! code ( conduct ) respect to controll]s or processors1 includ+ an explanation ( h[ ! indep5d5t organization is gov]n$4 7,f7 ,a description ( h[ ! entities describ$ 9 subp>agraph 7,c7 w be assess$ = compliance ) ! code ( conduct by ! indep5d5t organization describ$ 9 subp>agraph 7,e74 7,g7 ,a description ( h[ ! indep5d5t organization w ref] to ! ,commission or to a ,/ate attorney g5]al any controll] or processor t does n-- 7i7 meet ! requirem5ts ( ?is ,act2 or 7ii7 meet or exce$ ! requirem5ts ( ! ,act 9 accordance ) ! c]tification publicly disclos$ by ! controll] or processor "u subsection 7c74 7#c7 ,review by ,secret>y 7,a7 ,initial approval 7i7 ,public comm5t p]iod ,n lat] ?an #ij days aft] ! date on :i* ! ,secret>y receives an application submitt$ "u p>agraph 7#a71 ! ,secret>y %all publi% ! application & provide an opportunity = public comm5t on ! code ( conduct propos$ 9 ! application4 7ii7 ,approval crit]ia ,! ,secret>y1 9 consultation ) ! ,commission1 %all approve an application submitt$ "u p>agraph 7#a71 includ+ ! indep5d5t organization t w adm9i/] ! code ( conduct1 if ! controll] or processor 7or ! gr\p ( controll]s or processors7 t submits ! application demon/rates t ! code ( conduct propos$ 9 ! application meets ! foll[+ crit]ia3 7,i7 ,meets or exce$s ! relevant requirem5ts ( ?is ,act4 7,,ii7 ,provides = regul> review & validation by ! indep5d5t organization to ensure t ! controll] or processor 7or ! gr\p ( controll]s or processors7 t complies ) ! code ( conduct cont9ues to meet or exce$ ! relevant requirem5ts ( ?is ,act4 7,,iii7 ,includes ref]ral to ! ,commission = en=cem5t or ref]ral to ! appropriate ,/ate attorney g5]al = en=cem5t4 7iii7 ,timel9e ,n lat] ?an #a ye> aft] ! date on :i* ! ,secret>y receives an application submitt$ "u p>agraph 7#a71 ! ,secret>y %all issue a public det]m9ation approv+ or d5y+ ! application & provid+ ! reasons = su* approval or d5ial4 7,b7 ,approval ( modifications 7i7 ,9 g5]al ,if an indep5d5t organization t adm9i/]s a code ( conduct approv$ "u subp>agraph 7,a7 makes significant updates to ! code ( conduct-- 7,i7 ! indep5d5t organization %all submit to ! ,secret>y an application = approval ( ! significant updates made to ! code ( conduct2 & 7,,ii7 n lat] ?an #ij days aft] ! date on :i* ! ,secret>y receives an application = an updat$ code ( conduct submitt$ "u subclause 7,i71 ! ,secret>y %all publi% ! propos$ updat$ code ( conduct & provide an opportunity = public comm5t4 7ii7 ,timel9e ,n lat] ?an #ahj days aft] ! date on :i* ! ,secret>y receives an application = an updat$ code ( conduct submitt$ "u clause 7i77,i71 ! ,secret>y1 consid]+ ! approval crit]ia describ$ 9 subp>agraph 7,a77ii71 %all issue a public det]m9ation approv+ or d5y+ ! application & provid+ ! reasons = su* approval or d5ial4 7b7 ,)drawal ( approval 7#a7 ,9 g5]al ,if ! ,secret>y has cle> & conv9c+ evid5ce t a code ( conduct approv$ "u subsection 7a77#c7 no long] meets ! relevant requirem5ts ( ?is ,act or t compliance ) ! code ( conduct is insuffici5tly assess$ by ! indep5d5t organization t adm9i/]s ! code ( conduct1 ! ,secret>y %all notify ! relevant controll] or processor 7or ! relevant gr\p ( controll]s or processors7 & ! indep5d5t organization ( a pot5tial )drawal ( approval by ! ,secret>y & ( ! opportunity to cure any alleg$ defici5cy "u p>agraph 7#b74 7#b7 ,opportunity to cure 7,a7 ,9 g5]al ,n lat] ?an #ahj days aft] ! date on :i* a controll] or processor 7or a gr\p ( controll]s or processors7 receives ! notice describ$ 9 p>agraph 7#a71 ! controll] or processor 7or ! gr\p ( controll]s or processors7 & ! relevant indep5d5t organization may-- 7i7 create a propos$ cure to any alleg$ defici5cy ( ! code ( conduct or ! en=cem5t ( ! code ( conduct2 & 7ii7 submit ea* su* propos$ cure to ! ,secret>y4 7,b7 ,review ( propos$ cure ,if ! ,secret>y det]m9es )9 #fj days t a propos$ cure submitt$ "u subp>agraph 7,a77ii7 elim9ates an alleg$ defici5cy ( ! code ( conduct or ! assessm5t ( compliance ) ! code ( conduct1 ! ,secret>y may n )draw ! approval ( su* code ( conduct on ! basis ( su* defici5cy4 7#c7 ,)drawal ( approval 7,a7 ,det]m9ation ,if ! ,secret>y det]m9es t a propos$ cure submitt$ "u subp>agraph 7,a77ii7 does n elim9ate an alleg$ defici5cy ( ! code ( conduct or ! assessm5t ( compliance ) ! code ( ! conduct1 ! ,secret>y may )draw approval ( su* code ( conduct on ! basis ( su* defici5cy4 7,b7 ,notification ,n lat] ?an #aj days aft] ! date on :i* ! ,secret>y makes a det]m9ation "u subp>agraph 7,a71 ! ,secret>y %all notify ! relevant controll] or processor 7or ! relevant gr\p ( controll]s or processors7 & ! indep5d5t organization ( ! relevant )drawal ( approval describ$ 9 subp>agraph 7,a74 7,c7 ,effect ,a )drawal ( approval describ$ 9 subp>agraph 7,a7 %all take effect on ! date t is #cj days aft] ! date on :i* ! ,secret>y provides ! notification requir$ by subp>agraph 7,b74 7,d7 ,publication ,n lat] ?an #cj days aft] ! date on :i* ! ,secret>y provides notification requir$ by subp>agraph 7,b71 ! ,secret>y %all publi% on a publicly available website a notice ab\t ! relevant )drawal ( approval describ$ 9 subp>agraph 7,a74 7c7 ,public disclosure ,a controll] or processor t p>ticipates 9 a code ( conduct approv$ "u subsection 7a77#c7 %all c]tify on a publicly available website t ! controll] or processor is 9 compliance ) ! code ( conduct1 includ+ by li/+ ! indep5d5t organization t adm9i/]s ! code ( conduct4 7d7 ,rebuttable presumption ,a controll] or processor t complies ) a relevant code ( conduct approv$ "u subsection 7a77#c7 7or a relevant c]tification describ$ 9 subsection 7f77 %all be entitl$ to a rebuttable presumption t ! controll] or processor is 9 compliance ) ! relevant requirem5ts ( ?is ,act to :i* ! code ( conduct 7or c]tification7 applies4 7e7 ,codes ( conduct = small bus9esses 7#a7 ,9 g5]al ,n lat] ?an #b ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all publi% codes ( conduct = bus9esses t o!rwise w\ld be p]sons to :om ?is ,act applies b t d n meet ! applicability requirem5ts describ$ 9 section #ac7;a77#b74 7#b7 ,proc$ures ,9 c>ry+ out p>agraph 7#a71 ! ,secret>y %all-- 7,a7 foll[ ! same proc$ures describ$ 9 subsections 7a7 & 7b72 & 7,b7 solicit indep5d5t organizations to adm9i/] ! codes ( conduct4 7#c7 ,requirem5ts = code ( conduct ,a code ( conduct publi%$ "u p>agraph 7#a7 %all meet ! foll[+ requirem5ts3 7,a7 ,be consi/5t ) ! requirem5ts ( ?is ,act4 7,b7 ,be co/-effective = any p>ticipant 9 ! code ( conduct4 7,c7 ,be appropriate to ! risks1 size1 & limitations ( any su* p>ticipant4 7#d7 ,volunt>y p>ticipation ,p>ticipation 9 a code ( conduct publi%$ "u p>agraph 7#a7 %all be volunt>y4 7#e7 ,requirem5ts = p>ticipation ,a p>ticipant 9 a code ( conduct publi%$ "u p>agraph 7#a7 %all publicly self-c]tify t ! p>ticipant is 9 compliance ) ! code ( conduct1 includ+ by li/+ ! indep5d5t organization t adm9i/]s ! code ( conduct4 7f7 ,cross-,bord] privacy rules sy/em ,a c]tification by a controll] pursuant to ! ,global ,cross ,bord] ,privacy ,rules ,sy/em1 or any successor sy/em1 or a c]tification by a processor pursuant to ! ,global ,cross ,bord] ,privacy ,rules ,sy/em ,privacy ,recognition = ,processors1 or any successor sy/em1 %all be treat$ z p>ticipation 9 a code ( conduct approv$ "u subsection 7a77#c74 #i4 ,cross-bord] data fl[s 7a7 ,pr9cipal advisor ,! ,secret>y %all s]ve z ! pr9cipal advisor to ! ,presid5t on policy relat+ to ! int]national fl[ ( p]sonal data & ! protection ( p]sonal data 9 int]national comm]ce4 7b7 ,duties ,! ,secret>y %all take any action necess>y & appropriate to support ! int]national fl[ ( p]sonal data & ! protection ( p]sonal data 9 int]national comm]ce1 includ+ ! foll[+3 7#a7 ,assess+ ! laws1 regulations1 requirem5ts1 frameworks1 & practices 7& ! implem5tation !re(7 ( =eign gov]nm5ts =-- 7,a7 alignm5t ) ! consum] rights & protections ( p]sonal data describ$ 9 ?is ,act2 7,b7 any impact on consum]s & bus9esses 9 ! ,unit$ ,/ates1 includ+ ) respect to economic competitiv5ess1 innovation1 & data security2 & 7,c7 any impact on ! economic & security int]e/s ( ! ,unit$ ,/ates4 7#b7 ,develop+ policy & recomm5dations relat+ to-- 7,a7 id5tify+ ! b5efits ( ! int]national fl[ ( p]sonal data to consum]s & bus9esses1 includ+ economic competitiv5ess1 innovation1 & data security2 7,b7 address+ any negative impact on consum]s & bus9esses 9 ! ,unit$ ,/ates ( laws1 regulations1 requirem5ts1 frameworks1 & practices 7& ! implem5tation !re(7 ( =eign gov]nm5ts t limit or re/rict ! int]national fl[ ( p]sonal data2 7,c7 promot+ ! protection ( p]sonal data 9 a mann] t ma9ta9s ! int]national fl[ ( p]sonal data 9 int]national comm]ce2 & 7,d7 mitigat+ ! risk pos$ by cov]$ nations to ! int]national fl[ ( p]sonal data & ! protection ( p]sonal data 9 int]national comm]ce4 7#c7 ,e/abli%+1 ma9ta9+1 & promot+ frameworks1 c]tifications1 pr9ciples1 & p>tn]%ips to facilitate ! int]national fl[ ( p]sonal data = comm]cial purposes & ! protection ( p]sonal data 9 int]national comm]ce4 7#d7 ,coord9at+ ) any relevant ag5cy z ne$$4 7c7 ,int]national coop]ation 7#a7 ,au?ority to ent] agreem5t ,! ,secret>y1 z ! ,secret>y det]m9es appropriate1 may ent] into an agreem5t ) a =eign gov]nm5t1 int]national =um1 or =eign political or economic union to promote ! int]national fl[ ( p]sonal data & ! protection ( p]sonal data 9 int]national comm]ce4 7#b7 ,requirem5ts = agreem5t ,any agreem5t ent]$ into pursuant to p>agraph 7#a7-- 7,a7 may n h provisions t conflict ) ! protections = p]sonal data describ$ 9 ?is ,act2 7,b7 %all be consi/5t ) ! economic & security int]e/s ( ! ,unit$ ,/ates2 & 7,c7 n lat] ?an #fj days aft] ! date on :i* ! agreem5t is ent]$ into1 %all be submitt$ to ! ,committee on ,en]gy & ,comm]ce ( ! ,h\se ( ,repres5tatives & ! ,committee on ,comm]ce1 ,sci5ce1 & ,transportation ( ! ,s5ate4 7d7 ,rule ( con/ruction ,no?+ 9 ?is section may be con/ru$ to alt] ! au?ority ( any ag5cy ) rulemak+ & en=cem5t au?ority "u subtitle ,a ( title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 #aj4 ,/udy on univ]sal opt-out me*anisms 7a7 ,/udy ,n lat] ?an #c ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y %all publi% on a publicly available website a report t-- 7#a7 is develop$ ?r\gh a process ( public consultation2 7#b7 reviews comm]cially available te*nologies1 includ+ a web br[s] sett+ or ext5sion or a global sett+ on an electronic device1 t all[ a consum] to opt out ( ! process+ ( ! p]sonal data ( ! consum] by a controll]2 7#c7 consid]s ! feasibility ( a univ]sal opt-out me*anism 9 a mann] t makes use ( comm]cially available te*nologies & acc\nts = b5eficial uses ( p]sonal data2 & 7#d7 limits su* review & consid]ation 9 accordance ) ! scope ( ?is ,act4 7b7 ,comm]cially available te*nologies ,! comm]cially available te*nologies review$ pursuant to ! /udy requir$ by subsection 7a7 %all meet ! foll[+ requirem5ts3 7#a7 ,%all require a consum] to make an affirmative1 freely giv51 & unambigu\s *oice to indicate ! int5t ( ! consum] to opt out ( any process+ ( ! p]sonal data ( ! consum] by a controll]4 7#b7 ,%all be consum]-fri5dly & easy to use by ! av]age consum]4 7#c7 ,may n unduly burd5 lawful data process+ by a controll] or processor1 includ+ ) respect to b5eficial uses ( p]sonal data4 #aa4 ,rules ( con/ruction 7a7 ,9 g5]al ,no?+ 9 ?is ,act may be con/ru$ to re/rict ! ability ( a controll] or processor to d any ( ! foll[+3 7#a7 ,coop]ate ) a law en=cem5t ag5cy ) respect to conduct or activity t ! controll] or processor reasonably & 9 good fai? believes may violate a ,f$]al1 ,/ate1 or local law1 rule1 or regulation4 7#b7 ,inve/igate1 e/abli%1 ex]cise1 prep>e =1 or def5d a legal claim4 7#c7 ,provide a product or s]vice specifically reque/$ by a consum] or a p>5t ( a consum] 7if ! consum] is a *ild or te574 7#d7 ,p]=m a contract to :i* a consum] or a p>5t ( a consum] 7if ! consum] is a *ild or te57 is a p>ty1 includ+ by fulfill+ ! t]ms ( a writt5 w>ranty4 7#e7 ,take imm$iate /eps to protect an int]e/ t is ess5tial to ! life or physical safety ( a consum] or ( ano!r individual4 7#f7 ,prev5t1 detect1 protect aga9/1 or respond to a security incid5t1 includ+ a data security incid5t1 id5tity !ft1 fraud1 h>assm5t1 malici\s or deceptive activity1 or any o!r simil> illegal activity4 7#g7 ,pres]ve ! integrity or security ( sy/ems4 7#h7 ,inve/igate1 report1 or prosecute a p]son responsible = any su* security incid5t4 7#i7 ,engage 9 public or pe]-review$ sci5tific or /ati/ical rese>* 9 ! public int]e/ t adh]es to any applicable ,f$]al or ,/ate e?ics or privacy law & is approv$1 monitor$1 & gov]n$ by an in/itutional review bo>d 7or simil> indep5d5t ov]sight entity7 t consid]s ! foll[+3 7,a7 ,if ! deletion ( ! p]sonal data ( a consum] is likely to provide sub/antial b5efits t d n exclusively accrue to ! controll]4 7,b7 ,if ! controll] has implem5t$ reasonable safegu>ds to mitigate privacy & data security risks to a consum] associat$ ) rese>*1 includ+ any risks associat$ ) re-id5tification ( ! p]sonal data ( ! consum]4 7,c7 ,if ! expect$ b5efits ( ! rese>* outweigh su* privacy & data security risks4 7b7 ,p]sonal data ,no?+ 9 ?is ,act may be con/ru$ to re/rict ! ability ( a controll] or processor to collect1 use1 or reta9 ! p]sonal data ( a consum] to d any ( ! foll[+3 7#a7 ,conduct int]nal rese>* to develop1 improve1 or repair a product1 s]vice1 or te*nology4 7#b7 ,effectuate a product recall4 7#c7 ,id5tify & repair any te*nical error t impairs ! functionality ( a product1 s]vice1 or te*nology4 7#d7 ,p]=m an int]nal op]ation t-- 7,a7 is reasonably align$ ) ! expectations ( a consum]2 7,b7 is reasonably anticipat$ bas$ on ! relation%ip ( a consum] ) ! controll]2 or 7,c7 is o!rwise compatible ) process+ data to-- 7i7 provide a product or s]vice specifically reque/$ by a consum] or a p>5t ( a consum] 7if ! consum] is a *ild or te572 or 7ii7 p]=m a contract to :i* a consum] or a p>5t ( a consum] 7if ! consum] is a *ild or te57 is a p>ty4 7c7 ,privileg$ communication ,no?+ 9 ?is ,act may be con/ru$ to prev5t a controll] or processor f provid+ ! p]sonal data ( a consum] to a p]son cov]$ by an evid5ti>y privilege "u ,f$]al or ,/ate law z "p ( a privileg$ communication4 7d7 ,protect$ disclosure ,a controll] or processor t discloses ! p]sonal data ( a consum] to ano!r controll] or processor 9 compliance ) ! requirem5ts ( ?is ,act does n violate ?is ,act if ! controll] or processor t receives & processes su* p]sonal data violates ?is ,act if1 at ! "t ( disclos+ ! p]sonal data1 ! disclos+ controll] or processor did n h k t ! receiv+ controll] or processor int5d$ to commit su* a violation4 7e7 ,protect$ rights ,no?+ 9 ?is ,act may be con/ru$ z a requirem5t impos$ on a controll] or processor t adv]sely affects ! privacy or any o!r "r or fre$om ( any p]son1 includ+ ! "r to fre$om ( spee* "u ! ,con/itution ( ! ,unit$ ,/ates1 or t applies to ! process+ ( p]sonal data by a p]son 9 ! c\rse ( a purely p]sonal or h\sehold activity4 #ab4 ,en=cem5t 7a7 ,en=cem5t by ,commission 7#a7 ,unfair or deceptive acts or practices ,a violation ( ?is ,act %all be treat$ z a violation ( a regulation "u section #ah7;a77#a77;,b7 ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #eg;a7a77#a77;,b77 reg>d+ unfair or deceptive acts or practices4 7#b7 ,p[]s ( ,commission ,except z provid$ 9 p>agraphs 7#c7 & 7#d71 ! ,commission %all en=ce ?is ,act 9 ! same mann]1 by ! same means1 & ) ! same jurisdiction1 p[]s1 & duties z ?\gh all applicable t]ms & provisions ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 7 incorporat$ into & made a "p ( ?is ,act1 & any p]son :o violates ?is ,act %all be subject to ! p5alties & entitl$ to ! privileges & immunities provid$ 9 ! ,f$]al ,trade ,commission ,act4 7#c7 ,common c>ri]s ,not)/&+ section #d1 #e7;a77#b71 or #f ( ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #dd2 #de7;a77#b72 #df7 or any jurisdictional limitation ( ! ,f$]al ,trade ,commission1 ! ,f$]al ,trade ,commission %all also en=ce ?is ,act1 9 ! same mann] provid$ 9 p>agraphs 7#a7 & 7#b71 ) respect to common c>ri]s subject to ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq474 7#d7 ,civil rights violations 7,a7 ,exception ,not)/&+ p>agraphs 7#a71 7#b71 & 7#c71 ! ,commission may n en=ce any violation ( section #c7;c7 ( ?is ,act4 7,b7 ,transmission by ,commission ,if ! ,commission receives in=mation alleg+ t a controll] is 9 violation ( section #c7;c71 ! ,commission %all transmit su* in=mation1 z all[able "u ,f$]al law1 to any ag5cy ) au?ority to initiate an en=cem5t action or proce$+ relat+ to ! alleg$ violation describ$ 9 ! in=mation4 7b7 ,actions by ,/ates 7#a7 ,9 g5]al ,9 any case 9 :i* ! attorney g5]al ( a ,/ate has reason to believe t an int]e/ ( ! resid5ts ( su* ,/ate has be5 or is ?reat5$ or adv]sely affect$ by an act or practice 9 violation ( ?is ,act1 ! attorney g5]al1 z p>5s patriae1 may br+ a civil action on behalf ( ! resid5ts ( ! ,/ate 9 an appropriate di/rict c\rt ( ! ,unit$ ,/ates to-- 7,a7 enjo9 su* act or practice2 7,b7 en=ce compliance ) ?is ,act2 7,c7 obta9 damages1 re/itution1 or o!r comp5sation on behalf ( resid5ts ( ! ,/ate2 or 7,d7 obta9 su* o!r legal & equitable relief z ! c\rt may consid] to be appropriate4 7#b7 ,notice ,be=e fil+ an action "u ?is subsection1 ! attorney g5]al ( ! ,/ate involv$ %all provide to ! ,commission a writt5 notice ( su* action & a copy ( ! compla9t = su* action4 ,if ! attorney g5]al det]m9es t x is n feasible to provide ! notice describ$ 9 ?is p>agraph be=e ! fil+ ( ! action1 ! attorney g5]al %all provide writt5 notice ( ! action & a copy ( ! compla9t to ! ,commission imm$iately ^u ! fil+ ( ! action4 7#c7 ,au?ority ( ,commission 7,a7 ,9 g5]al ,on receiv+ notice "u p>agraph 7#b7 ( an action "u ?is subsection1 ! ,commission %all h ! "r-- 7i7 to int]v5e 9 ! action2 7ii7 ^u s int]v5+1 to be he>d on all matt]s aris+ !re92 & 7iii7 to file petitions = appeal4 7,b7 ,limitation on ,/ate action :ile ,f$]al action is p5d+ ,if ! ,commission or ! ,attorney ,g5]al ( ! ,unit$ ,/ates has in/itut$ a civil action = violation ( ?is ,act 7ref]r$ to 9 ?is subp>agraph z ! ,f$]al action71 no ,/ate attorney g5]al may br+ an action "u ?is subsection dur+ ! p5d5cy ( ! ,f$]al action aga9/ any def5dant nam$ 9 ! compla9t 9 ! ,f$]al action = any violation ( ?is ,act alleg$ 9 su* compla9t4 7#d7 ,rule ( con/ruction ,= purposes ( br++ a civil action "u ?is subsection1 no?+ 9 ?is ,act may be con/ru$ to prev5t an attorney g5]al ( a ,/ate f ex]cis+ ! p[]s conf]r$ on ! attorney g5]al by ! laws ( su* ,/ate to conduct inve/igations1 adm9i/] oa?s & affirmations1 or compel ! att5dance ( witnesses or ! production ( docum5t>y & o!r evid5ce4 7c7 ,"r ,to cure 7#a7 ,9 g5]al ,nei!r ! ,commission nor a ,/ate attorney g5]al may initiate any action = a violation ( ?is ,act until-- 7,a7 ! ,commission or ! attorney g5]al has provid$ writt5 notice to a controll] or processor alleg$ to be 9 violation ( ?is ,act ( ! alleg$ violation t id5tifies ! specific provision ( ?is ,act alleg$ to h be5 violat$2 & 7,b7 n few] ?an #de days h pass$ s9ce ! date on :i* su* writt5 notice has be5 provid$4 7#b7 ,effect ( cure ,!re %all be no violation ( ?is ,act ) respect to an allegation made "u p>agraph 7#a77;,a7 if1 dur+ ! p]iod ( "t describ$ 9 p>agraph 7#a77;,b71 ! controll] or processor alleg$ to be 9 violation ( ?is ,act cures ! alleg$ violation ( ?is ,act & provides ! ,commission or ! ,/ate attorney g5]al ) a writt5 /atem5t t su* violation has be5 cur$ & t no su* fur!r violation %all occur4 7#c7 ,failure to cure ,! ,commission or ! ,/ate attorney g5]al may initiate an action pursuant to subsection 7a7 or 7b7 7z ! case may be7 to rem$y an allegation made "u p>agraph 7#a77;,a7 if ! controll] or processor alleg$ to be 9 violation ( ?is ,act-- 7,a7 fails to cure ! alleg$ violation pursuant to p>agraph 7#b72 or 7,b7 aft] cur+ ! alleg$ violation pursuant to p>agraph 7#b71 cont9ues to violate ?is ,act4 #ac4 ,applicability 7a7 ,9 g5]al ,?is ,act %all apply to any p]son t is subject to ! ,f$]al ,trade ,commission ,act 7#ae ,u4,s4,c4 #da et seq47 or is a common c>ri] subject to title ,,ii ( ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #bja et seq47 &-- 7#a7 ) respect to ! bus9ess ( ! p]son-- 7,a7 conducts bus9ess 9 ! ,unit$ ,/ates or (f]s = use or sale to a resid5t ( ! ,unit$ ,/ates a product or s]vice2 or 7,b7 processes or engages 9 ! sale ( p]sonal data ( a resid5t ( ! ,unit$ ,/ates2 & 7#b7 ) respect to p]sonal data & annual gross rev5ue 9 ! c\rse ( su* bus9ess-- 7,a7 collects & processes p]sonal data ( m ?an #bjj1jjj consum]s annually 7exclud+ p]sonal data controll$ or process$ solely = ! purpose ( complet+ a paym5t transaction7 & has an annual gross rev5ue ( #be1jjj1jjj or m 7z adju/$ on ,janu>y #a ea* ye> by ! p]c5tage increase 7if any71 dur+ ! prec$+ #ab-mon? p]iod1 9 ! ,consum] ,price ,index = ,all ,urban ,consum]s publi%$ by ! ,bureau ( ,labor ,/ati/ics72 or 7,b7 collects & processes p]sonal data ( #ajj1jjj or m consum]s annually 7exclud+ p]sonal data controll$ or process$ solely = ! purpose ( complet+ a paym5t transaction7 & d]ives #be p]c5t or m ( ! annual gross rev5ue ( ! p]son f ! sale ( su* p]sonal data4 7b7 ,exemptions ,?is ,act does n apply to ! foll[+3 7#a7 ,a ,f$]al1 ,/ate1 or local gov]nm5tal entity4 7#b7 ,an entity t collects1 processes1 reta9s1 or transf]s p]sonal data on behalf ( su* ,f$]al or ,/ate gov]nm5tal entity1 to ! ext5t t su* entity is act+ z a processor to ! gov]nm5tal entity4 7#c7 ,a f9ancial in/itution subject to title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7#d7 ,a cov]$ entity or bus9ess associate subject to p>ts #afj & #afd ( title #de1 ,code ( ,f$]al ,regulations4 7#e7 ,a nonpr(it organization4 7#f7 ,a nonpr(it organization ) ! prim>y mission ( prev5t+1 inve/igat+1 or det]r+ fraud1 tra9+ anti-fraud pr(essionals1 or educat+ ! public ab\t fraud1 includ+ insurance fraud1 securities fraud1 & f9ancial fraud4 7#g7 ,an in/itution ( high] education4 7#h7 ,! ,national ,c5t] = ,miss+ & ,exploit$ ,*ildr54 7#i7 ,an entity creat$ by a ,f$]al or ,/ate /atute to pay = claims aris+ f ! liquidation ( an insurance company4 7#aj7 ,a futures association regi/]$ pursuant to section #ag ( ! ,commodity ,ex*ange ,act 7#g ,u4,s4,c4 #ba74 7#aa7 ,a national securities association regi/]$ pursuant to section #ae;,a ( ! ,securities ,ex*ange ,act ( #aicd 7#ae ,u4,s4,c4 #gho-#c74 7#ab7 ,data process$ or ma9ta9$-- 7,a7 by an individual apply+ to1 employ$ by1 or act+ z an ag5t or indep5d5t contractor ( a controll] or processor = su* application1 employm5t1 or action2 7,b7 = inclusion 9 ! em]g5cy contact in=mation relat+ an individual2 or 7,c7 t is necess>y = ! adm9i/ration ( b5efits = an individual4 7#ac7 ,! foll[+ in=mation3 7,a7 ,heal? in=mation protect$ "u & collect$ or us$ = public heal? activities & purposes 9 accordance ) ,,hipaa4 7,b7 ,heal? records4 7,c7 ,records relat+ to ! id5tity1 diagnosis1 prognosis1 or treatm5t ( a pati5t "u section #edc ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bij;dd-#b74 7,d7 ,data1 in=mation1 or id5tifiable private in=mation 7z su* t]m is def9$ 9 section #df4ajb ( title #de1 ,code ( ,f$]al ,regulations7 obta9$ pursuant to any ( ! foll[+3 7i7 ,"p #df ( title #de1 ,code ( ,f$]al ,regulations4 7ii7 ,! ,guidel9e = ,good ,cl9ical ,practice ,e#f7,r#c7 issu$ by ,! ,int]national ,c\ncil = ,h>monisation ( ,te*nical ,requirem5ts = ,ph>maceuticals = ,human ,use4 7iii7 ,"p #ej or "p #ef ( title #ba1 ,code ( ,f$]al ,regulations4 7,e7 ,in=mation report$ pursuant to ! ,heal? ,c>e ,quality ,improvem5t ,act ( #aihf 7#db ,u4,s4,c4 #aaaja et seq474 7,f7 ,id5tifiable pati5t safety "w product & nonid5tifiable pati5t safety "w product 7z su* t]ms are def9$ 9 section #iba ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bii;b-#ba77 protect$ "u ,"p ,c ( title ,,ix ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bii;b-#ba et seq474 7,g7 ,in=mation d]iv$ f any ( ! heal? c>e relat$ in=mation li/$ 9 ?is p>agraph t is de-id5tifi$ 9 accordance ) section #afd4ead7;e7 ( title #de1 ,code ( ,f$]al ,regulations4 7,h7 ,in=mation t is includ$ 9 a limit$ data set 9 accordance ) ! /&>ds & specifications "u section #afd4ead7;e7 ( title #de1 ,code ( ,f$]al ,regulations4 7,i7 ,p]sonal data t-- 7i7 may impact ! cr$itwor?9ess1 cr$it /&+1 cr$it capacity1 "*1 g5]al reputation1 p]sonal *>act]i/ics1 or mode ( liv+ ( a consum]2 & 7ii7 is collect$ or disclos$ by a consum] report+ ag5cy 7z su* t]m is def9$ 9 section #fjc7;f7 ( ! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha;a7f777 or a furni%]1 to ! ext5t t ! consum] report+ ag5cy or furni%] is engag$ 9 activities subject to ! ,fair ,cr$it ,report+ ,act4 7,j7 ,p]sonal in=mation 7z su* t]m is def9$ 9 section #bgbe ( title #ah1 ,unit$ ,/ates ,code7 collect$1 process$1 sold1 or disclos$ "u section #bgba ( title #ah1 ,unit$ ,/ates ,code4 7,k7 ,p]sonally id5tifiable in=mation & p]sonally id5tifiable data regulat$ 9 accordance ) section #ddd ( ! ,g5]al ,education ,provisions ,act 7commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 7#bj ,u4,s4,c4 #abcb;g74 7,l7 ,p]sonal data collect$1 process$1 sold1 or disclos$ z a result ( an activity au?oriz$ "u ! ,f>m ,cr$it ,act ( #aiga 7#ab ,u4,s4,c4 #bjja et seq474 7,m7 ,nonpublic p]sonal in=mation 7z su* t]m is def9$ 9 section #eji ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhji774 7,n7 ,any in=mation t orig9ates f1 is int]m+l$ )1 or is treat$ 9 ! same mann] z in=mation describ$ 9 subp>agraphs 7,a7 ?r\gh 7,m7 t is ma9ta9$ by ! foll[+3 7i7 ,a cov]$ entity or bus9ess associate4 7ii7 ,a program or a qualifi$ s]vice organization 7z su* t]ms are def9$ 9 section #b4aa ( title #db1 ,code ( ,f$]al ,regulations74 #ad4 ,relation%ip to ,f$]al laws 7a7 ,9 g5]al ,no?+ 9 ?is ,act may be con/ru$ to relieve or *ange an obligation t a controll] or processor may h "u any ( ! foll[+3 7#a7 ,! ,*ildr5's ,onl9e ,privacy ,protection ,act ( #aiih 7#ae ,u4,s4,c4 #feja et seq74 7#b7 ,title ,v ( ! ,gramm-,lea*-,bliley ,act 7#ae ,u4,s4,c4 #fhja et seq474 7#c7 ,"p ,c ( title ,,xi ( ! ,social ,security ,act 7#db ,u4,s4,c4 #acbj;d et seq474 7#d7 ,subtitle ,d ( ! ,,hite* ,act 7#db ,u4,s4,c4 #agiba et seq474 7#e7 ,any regulations promulgat$ "u section #bfd7;c7 ( ,,hipaa 7#db ,u4,s4,c4 #acbj;d-#b note74 7#f7 ,! requirem5ts reg>d+ ! confid5tiality ( sub/ance use disord] in=mation "u section #edc ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bij;dd-#b7 or any regulation promulgat$ "u su* section4 7#g7 ,! ,fair ,cr$it ,report+ ,act 7#ae ,u4,s4,c4 #afha et seq474 7#h7 ,section #ddd ( ! ,g5]al ,education ,provisions ,act 7commonly kn[n z ! ,family ,educational ,rights & ,privacy ,act ( #aigd7 7#bj ,u4,s4,c4 #abcb;g7 & "p #ii ( title #cd1 ,code ( ,f$]al ,regulations 7or any successor regulation71 to ! ext5t a controll] or processor is an educational ag5cy or in/itution 7z su* t]m is def9$ 9 #ii4c ( su* title 7or any successor regulation774 7#i7 ,! regulations relat$ to ! protection ( human subjects "u "p #df ( title #de1 ,code ( ,f$]al ,regulations4 7#aj7 ,! ,heal? ,c>e ,quality ,improvem5t ,act ( #aihf 7#db ,u4,s4,c4 #aaaja et seq474 7#aa7 ,"p ,c ( title ,,ix ( ! ,public ,heal? ,s]vice ,act 7#db ,u4,s4,c4 #bii;b-#ba et seq474 7#ab7 ,*apt] #abc ( title #ah1 ,unit$ ,/ates ,code4 7b7 ,relation%ip to ,communications ,act ( #aicd 7#a7 ,9 g5]al ,except z provid$ 9 p>agraph 7#b71 ! ,communications ,act ( #aicd 7#dg ,u4,s4,c4 #aea et seq471 & any regulation promulgat$ by ! ,f$]al ,communications ,commission pursuant to su* ,act1 %all n apply to a controll] or processor ) respect to ! collection1 use1 process+1 transf]r+1 or security ( p]sonal data4 7#b7 ,exception ,p>agraph 7#a7 does n apply to ! ext5t a regulation or ord] p]ta9s solely to em]g5cy s]vices4 7c7 ,repeal ,section #bgaj ( title #ah1 ,unit$ ,/ates ,code1 is repeal$4 #ae4 ,relation%ip to ,/ate laws ,no ,/ate or political subdivision ( a ,/ate may prescribe1 ma9ta91 or en=ce any law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision hav+ ! =ce & effect ( law1 if su* law1 rule1 regulation1 requirem5t1 /&>d1 or o!r provision relates to ! provisions ( ?is ,act4 #af4 ,def9itions ,9 ?is ,act3 7#a7 ,affiliate 7,a7 ,9 g5]al ,! t]m affiliate means a legal entity t controls1 is controll$ by1 or is "u common control ) ano!r legal entity or %>es common br&+ ) ano!r legal entity4 7,b7 ,control2 controll$ ,9 subp>agraph 7,a71 ! t]ms control & controll$ mean-- 7i7 own]%ip (1 or ! p[] to vote1 m ?an #ej p]c5t ( ! out/&+ %>es ( any class ( vot+ security ( a company2 7ii7 control 9 any mann] ov] ! election ( a majority ( ! directors or ( individuals ex]cis+ simil> functions2 or 7iii7 ! p[] to ex]cise controll+ influ5ce ov] ! managem5t ( a company4 7#b7 ,ag5cy ,! t]m ag5cy has ! mean+ giv5 t t]m 9 section #eea ( title #e1 ,unit$ ,/ates ,code4 7#c7 ,au!nticate ,! t]m au!nticate means to v]ify ?r\gh comm]cially reasonable means t ! consum]1 entitl$ to ex]cise ! consum] rights describ$ "u section #b1 is ! same consum] t ex]cises su* a consum] "r ) respect to ! relevant p]sonal data4 7#d7 ,biometric data ,! t]m biometric data-- 7,a7 means data g5]at$ by automatic measurem5ts ( ! biological *>act]i/ics ( an individual1 su* z a f+]pr9t1 voicepr9t1 eye ret9as1 irises1 or o!r unique biological patt]ns or *>act]i/ics t is us$ to id5tify a specific individual2 & 7,b7 does n include a physical or digital photograph1 a video or audio record+ 7or data g5]at$ !refrom71 or in=mation collect$1 us$1 or /or$ = heal? c>e treatm5t1 paym5t1 or op]ations pursuant to ,,hipaa4 7#e7 ,bus9ess associate2 cov]$ entity2 heal?c>e provid]2 protect$ heal? in=mation ,! t]ms bus9ess associate1 cov]$ entity1 heal?c>e provid]1 & protect$ heal? in=mation h ! mean+s giv5 ^? t]ms 9 = purposes ( regulations promulgat$ pursuant to section #bfd7;c7 ( ! ,heal? ,insurance ,portability & ,acc\ntability ,act 7#db ,u4,s4,c4 #acbj;d-#b note74 7#f7 ,*ild ,! t]m *ild means an individual :o is "u ! age ( #ac4 7#g7 ,commission ,! t]m ,commission means ! ,f$]al ,trade ,commission4 7#h7 ,cons5t ,! t]m cons5t-- 7,a7 means a cle> affirmative act t signifies ! freely giv51 specific1 in=m$1 & unambigu\s agreem5t by a consum] to process p]sonal data relat+ to ! consum]2 & 7,b7 includes a writt5 /atem5t1 includ+ a /atem5t writt5 by electronic means1 or any o!r unambigu\s affirmative action4 7#i7 ,consum] ,! t]m consum] means-- 7,a7 an individual t acts 9 an individual or h\sehold capacity2 & 7,b7 does n include an individual t acts 9 a comm]cial or employm5t context4 7#aj7 ,controll] ,! t]m controll] means a p]son t1 alone or jo9tly ) o!rs1 det]m9es ! purpose & means ( process+ p]sonal data4 7#aa7 ,cov]$ nation ,! t]m cov]$ nation has ! mean+ giv5 t t]m 9 section #dhgb7;f7 ( title #aj1 ,unit$ ,/ates ,code4 7#ab7 ,data brok] 7,a7 ,9 g5]al ,! t]m data brok] means a controll] t meets ! foll[+-- 7i7 ,! controll] collects & processes p]sonal data conc]n+ a consum] :o is n3 7,i7 a cu/om] or a cli5t ( ! controll]2 or 7,,ii7 a us]1 read]1 or subscrib] ( a product or s]vice provid$ by ! controll]2 & 7ii7 ,! controll] d]ives #ej p]c5t or m ( annual gross rev5ue f ! sale ( su* p]sonal data4 7,b7 ,limitation ,! t]m data brok] does n include a p]son act+ z a processor4 7#ac7 ,decision t has a legal or simil>ly significant effect ,! t]m decision t has a legal or simil>ly significant effect means a decision made by a controll] ab\t a consum] to d5y "o ( ! foll[+ to ! consum]3 7,a7 ,a heal?c>e s]vice 7z def9$ 9 "p #cah4b ( title #af1 ,code ( ,f$]al ,regulations74 7,b7 ,a r5tal or lease ( h\s+4 7,c7 ,an employm5t opportunity4 7#ad7 ,deid5tifi$ data ,! t]m deid5tifi$ data means data t _c reasonably be l9k$ to an id5tifi$ or id5tifiable individual or a device l9k$ to an individual4 7#ae7 ,heal? record ,! t]m heal? record means a record1 o!r ?an = f9ancial or bill+ purposes1 relat+ to an individual1 kept by a heal? c>e provid] z a result ( ! pr(essional relation%ip e/abli%$ betwe5 ! heal? c>e provid] & ! individual4 7#af7 ,,hipaa ,! t]m ,,hipaa means ,heal? ,insurance ,portability & ,acc\ntability ,act ( #aiif 7#db ,u4,s4,c4 #acbj;d et seq474 7#ag7 ,id5tifi$ or id5tifiable natural p]son ,! t]m id5tifi$ or id5tifiable natural p]son means a p]son :o c be readily id5tifi$1 directly or indirectly4 7#ah7 ,in/itution ( high] education ,! t]m in/itution ( high] education has ! mean+ giv5 t t]m 9 section #aja ( ,high] ,education ,act ( #aife 7#bj ,u4,s4,c4 #ajja74 7#ai7 ,nonpr(it organization ,! t]m nonpr(it organization means an organization t is describ$ 9 section #eja7;c77#c7 ( ! ,int]nal ,rev5ue ,code ( #aihf & exempt f taxation "u section #eja7;a7 ( su* ,code4 7#bj7 ,p>5t ,! t]m p>5t1 ) respect to a *ild or te51 means an adult ) ! legal "r to make decisions on behalf ( ! *ild or te51 includ+-- 7,a7 a natural p>5t2 7,b7 an adoptive p>5t2 7,c7 a legal gu>dian2 & 7,d7 an individual ) legal cu/ody ov] ! *ild or te54 7#ba7 ,p]sonal data ,! t]m p]sonal data-- 7,a7 means any in=mation t is l9k$ or reasonably l9kable to an id5tifi$ or id5tifiable natural p]son2 & 7,b7 does n include deid5tifi$ data or publicly available in=mation4 7#bb7 ,precise geolocation data ,! t]m precise geolocation data-- 7,a7 means in=mation d]iv$ f te*nology1 includ+ global position+ sy/em level latitude & longitude coord9ates or o!r me*anisms1 t directly id5tifies ! specific location ( a natural p]son ) precision & accuracy )9 a radius ( #a1gej feet2 & 7,b7 does n include-- 7i7 ! cont5t ( communications2 or 7ii7 any data g5]at$ by or connect$ to advanc$ utility met]+ infra/ructure sy/ems or equipm5t = use by a utility4 7#bc7 ,process or process+ ,! t]m process or process+ means any op]ation or set ( op]ations p]=m$1 :e!r by manual or automat$ means1 on p]sonal data or on sets ( p]sonal data1 su* z ! collection1 use1 /orage1 disclosure1 analysis1 deletion1 or modification ( p]sonal data4 7#bd7 ,processor ,! t]m processor means a p]son t processes p]sonal data on behalf ( a controll]4 7#be7 ,pr(il+ ,! t]m pr(il+ means any =m ( process+ t is solely automat$ & p]=m$ on p]sonal data to evaluate1 analyze1 or pr$ict p]sonal aspects ( ! economic situation1 heal?1 p]sonal pref]5ce1 int]e/1 reliability1 behavior1 location1 or movem5t ( an id5tifi$ or id5tifiable consum]4 7#bf7 ,pseudonym\s data ,! t]m pseudonym\s data means p]sonal data t _c be attribut$ to a specific individual )\t ! use ( additional in=mation if ! additional in=mation is kept sep>ately & is subject to appropriate adm9i/rative & te*nical measures to ensure t ! p]sonal data is n attribut$ to an id5tifi$ or id5tifiable individual4 7#bg7 ,publicly available in=mation ,! t]m publicly available in=mation means in=mation t is lawfully made available ?r\gh ,f$]al1 ,/ate1 or local gov]nm5t records1 or in=mation t a bus9ess has a reasonable basis to believe is lawfully made available to ! public ?r\gh widely di/ribut$ m$ia1 by ! consum]1 or by a p]son to :om ! consum] has disclos$ ! in=mation1 unless ! consum] has re/rict$ ! in=mation to a specific audi5ce4 7#bh7 ,sale ( p]sonal data ,! t]m sale ( p]sonal data-- 7,a7 means ! ex*ange ( p]sonal data = monet>y consid]ation by ! controll] to ano!r controll] or to a gov]nm5tal entity2 & 7,b7 does n include-- 7i7 ! disclosure ( p]sonal data to a processor t processes ! p]sonal data on behalf ( ! controll]2 7ii7 ! disclosure ( p]sonal data to ano!r controll] = ! purposes ( provid+ a product or s]vice reque/$ by ! consum]2 7iii7 ! disclosure or transf] ( p]sonal data to an affiliate ( ! controll]2 7iv7 ! disclosure ( in=mation t ! consum] int5tionally made available to ! public2 7v7 ! disclosure or transf] ( p]sonal data to ano!r controll] z an asset t is "p ( a m]g]1 acquisition1 bankruptcy1 or o!r transaction 9 :i* ! new controll] assumes control ( any ( ! assets ( ! previ\s controll]2 or 7vi7 ! disclosure ( p]sonal data 9 ! c\rse ( report+1 news-ga!r+1 speak+1 or o!r activities int5d$ to in=m ! public on matt]s ( public int]e/ or public conc]n4 7#bi7 ,secret>y ,! t]m ,secret>y means ! ,secret>y ( ,comm]ce4 7#cj7 ,s5sitive data ,! t]m s5sitive data means a category ( p]sonal data t includes-- 7,a7 p]sonal data t discloses racial or e?nic orig91 religi\s belief1 m5tal or physical heal? diagnosis1 sexual ori5tation1 or citiz5%ip or immigration /atus2 7,b7 g5etic or biometric data t is process$ = ! purpose ( uniquely id5tify+ a specific individual2 7,c7 p]sonal data collect$ f a *ild or te52 & 7,d7 precise geolocation data4 7#ca7 ,/ate ,! t]m ,/ate means ea* ,/ate ( ! ,unit$ ,/ates1 ! ,di/rict ( ,columbia1 ea* commonweal?1 t]ritory1 or possession ( ! ,unit$ ,/ates1 & ea* f$]ally recogniz$ ,indian ,tribe4 7#cb7 ,t>get$ adv]tis+ ,! t]m t>get$ adv]tis+-- 7,a7 means to display an adv]tisem5t to a consum] 9 :i* ! adv]tisem5t is select$ bas$ on p]sonal data obta9$ f ! activities ( t consum] ov] "t & across nonaffiliat$ websites or onl9e applications to pr$ict ! pref]5ces or int]e/s ( t consum]2 & 7,b7 does n include-- 7i7 an adv]tisem5t bas$ on activities )9 ! website or onl9e application ( a controll]2 7ii7 an adv]tisem5t bas$ on ! context ( a curr5t se>* qu]y1 visit to a website1 or onl9e application ( a consum]2 7iii7 an adv]tisem5t direct$ to a consum] 9 response to ! reque/ = in=mation or fe$back by ! consum]2 or 7iv7 process+ p]sonal data process$ solely = measur+ or report+ adv]tis+ or cont5t p]=mance1 rea*1 or frequ5cy1 includ+ indep5d5t measurem5t4 7#cc7 ,te5 ,! t]m te5 means an individual :o is ! age ( #ac or ov] & "u ! age ( #af4 7#cd7 ,trade secret ,! t]m trade secret has ! mean+ giv5 t t]m 9 section #ahci ( title #ah1 ,unit$ ,/ates ,code4 7#ce7 ,v]ifiable cons5t ,! t]m v]ifiable cons5t means any reasonable ef=t 7tak+ into consid]ation available te*nology7 by a controll]1 includ+ a reque/ = au?orization = future process+ ( p]sonal data1 to ensure t ! p>5t ( a te5-- 7,a7 receives direct notice ( ! process+ practices ( ! controll] ) respect to p]sonal data2 & 7,b7 be=e ! p]sonal data ( ! te5 is collect$1 freely & unambigu\sly au?orizes-- 7i7 ! process+ ( ! p]sonal data2 & 7ii7 any subsequ5t use ( ! p]sonal data4 #ag4 ,sev]ability ,if any provision ( ?is ,act or ! application ( ?is ,act to any p]son or circum/ance is held invalid1 ! rema9+ provisions ( ?is ,act & ! application ( ?is ,act to o!r p]sons or circum/ances %all n be affect$4 #ah4 ,effective dates 7a7 ,9 g5]al ,except z provid$ 9 subsection 7b71 ?is ,act %all take effect #b ye>s aft] ! date ( ! enactm5t ( ?is ,act4 7b7 ,exceptions ,not)/&+ subsection 7a71 sections #b1 #d1 & #e %all take effect #a ye> aft] ! date ( ! enactm5t ( ?is ,act4