WeVote
Log In

Bill

Bill

SB 659

Relating to waiver of tuition.

2025 Regular Session Introduced by Daniel Bonham and 1 co-sponsor

Establishes a comprehensive consumer data privacy law granting residents rights over their data, imposing duties on collectors/processors, and creating enforcement mechanisms and a

In committee upon adjournment.
0
WeVote Research Nonpartisan
Bill Summary · SB 659

SB 659 — Personal Data Privacy Act (Summary)

Status: Referred to Committee on Government Operations (introduced Feb 20, 2025).
Primary subject: Consumer protection — privacy; creation of a personal data privacy law.

Purpose / Policy goal

SB 659 would create a comprehensive consumer privacy statute (the "Personal Data Privacy Act") establishing consumer rights over personal data, setting duties for entities that collect or process personal data, creating a registry for data brokers, and providing enforcement tools (civil penalties, private right of action, and Attorney General authority). The bill aims to require consent for certain processing, prohibit harmful practices (e.g., dark patterns), and increase transparency and control for residents over how their personal data is used.

Key provisions and requirements

  • Scope and applicability

    • Applies to persons doing business in the state and to entities meeting size thresholds (e.g., controllers/processors that control or process personal data of at least 100,000 consumers, or at least 25,000 consumers and that derive revenue from sale of personal data).
    • Explicit exemptions for certain categories (state agencies, HIPAA-covered entities/medical data, and other specified data and actors).

  • Consumer rights

    • Right to access copies of collected personal data.
    • Right to deletion of personal data.
    • Right to opt out of processing for specific purposes, including targeted advertising.
    • Right to a universal opt‑out mechanism (a state‑level or standardized opt‑out tool is provided).
    • Rights must be invokeable through a prescribed request process; controllers must authenticate requests by reasonable means.

  • Consent and prohibited practices

    • Controllers generally must obtain consumer consent before processing personal data (consent defined as freely given, specific, informed, and unambiguous).
    • Bars use of “dark patterns” to obtain consent or steer choices.
    • Limits certain automated decisioning that produces legal or similarly significant effects without safeguards.

  • Notices and governance

    • Controllers must provide a clear privacy notice describing purposes of collection/processing.
    • Controllers must conduct and document Data Protection Impact Assessments for uses of personal data requiring heightened review.
    • Processors must assist controllers in meeting obligations (e.g., handling rights requests).

  • De‑identified and pseudonymous data

    • Sets standards for handling and re‑identification risk; imposes obligations where de‑identified data is used.

  • Special data categories

    • Defines and provides protections for biometric data, precise geolocation (defined as location within a radius of ~1,750 feet), consumer health and gender‑affirming health data, and children (child = under 13).

  • Data Broker Registry

    • Requires data brokers to register with the Attorney General.
    • Establishes a Data Broker Registry Fund; AG may set registration fees (fees intended to cover registry setup/maintenance).

Enforcement, remedies, and penalties

  • Attorney General enforcement and civil actions permitted.
  • Private right of action for consumers under certain circumstances.
  • Civil fines specified in committee analyses: examples include $5,000 for failure to cooperate with AG investigation and $7,500 for violations (committee reports indicate these fines would be deposited into a Consumer Privacy Fund). The bill text as reported includes an array of penalties and remedies; exact amounts and multipliers vary by violation severity in substitute language.
  • Creation of two funds in state treasury:
    • Consumer Privacy Fund (to receive civil fines).
    • Data Broker Registry Fund (to receive registration fees).
  • Filing fees for AG civil actions may be waived.

Who would be affected

  • Businesses and organizations that control or process substantial amounts of residents’ personal data (subject to the thresholds above).
  • Data brokers who collect and sell consumer personal data (subject to registration).
  • Processors contracted by controllers (have contractual duties).
  • Consumers/residents of the state gain new rights and remedies.
  • Attorney General and state courts (responsible for enforcement and administration).

Fiscal and administrative notes

  • Committee reports forecast an indeterminate fiscal impact on the Attorney General (initial registry setup, enforcement costs) and a minor negative impact on state circuit courts (waived filing fees). The AG may set registration fees to cover registry costs. Funds created would not lapse to the General Fund.

Definitions and notable technical terms (selected)

  • Consent: clear, affirmative act; excludes broad terms‑of‑service acceptance or agreements obtained through dark patterns.
  • Dark pattern: UI designed to impair user autonomy/choice.
  • Biometric data: data from automatic measurements (e.g., fingerprint, voiceprint), excluding ordinary photos or recordings unless used to identify a person.
  • Precise geolocation: location data accurate within ~1,750 feet.

Timeline / Legislative status (high-level)

  • Original introduction and committee work occurred in 2023–2024 (Substitute S‑2 reported and passed the Senate Dec 12, 2024).
  • Committee reports and fiscal analyses completed (Dec 2024).
  • Subsequent legislative activity in 2025 includes readings, referrals, and hearings: referred to Committee on Government Operations (Feb 20, 2025), hearings in spring 2025, re‑referrals to Appropriations and other committees; as of May 23, 2025 the bill was held in committee and under submission. (See legislative history for detailed chronology.)

If you want, I can:
- Produce a one‑page “quick facts” sheet for stakeholders (business, legal counsel, consumers).
- Extract the bill’s definitions and produce a side‑by‑side comparison with existing state or federal privacy laws.

Compiled from official sources — confirm details with the bill’s official record.

Sign in to ask a question.