Technology (Consumer Data Protection)

This bill establishes comprehensive privacy protections for personal data collected by District of Columbia government agencies and third parties on their behalf. It creates a new Chief Privacy Officer role within the Office of the Chief Technology Officer to oversee compliance and grants residents, employees, and service users specific rights over their information. Key provisions require agencies to obtain clear affirmative consent before selling data, strictly limit data collection to what is necessary for government services, and define sensitive categories such as health records and government identifiers that warrant extra care. The legislation also sets rules for how third parties must handle data received from the government and defines what constitutes personal versus de-identified information.

The Surveillance Pricing Prohibition Amendment Act of 2026 prohibits companies in the District of Columbia from using personal data to charge different prices for the same goods or services. It achieves this by legally defining 'surveillance-based price discrimination' as setting prices based on information gathered through electronic surveillance, such as device tracking or biometric monitoring, and classifying this practice as an unfair trade activity. This law directly affects digital marketplaces and other businesses that currently use consumer data to manipulate pricing, ensuring that quoted prices reflect market value rather than individual customer profiles.

This bill protects District of Columbia residents' health data by requiring companies that collect it to obtain explicit consent before use, publish clear privacy policies, and allow data deletion within 183 days. It directly affects health apps, medical providers, and any organization handling personal health information (like medical records or mental health data). Key provisions ban location tracking near health facilities (geofencing), mandate transparent data-sharing disclosures, and give people the right to demand data removal. The law creates enforceable privacy rules for health data, aligning DC with similar state-level protections.

This bill requires insurance licensees in the District of Columbia to meet specific data security standards to protect consumer information. It mandates that licensees investigate cybersecurity incidents, notify the Department of Insurance, Securities and Banking Commissioner about such events, and implement security measures for nonpublic information stored on portable devices or transmitted externally. The law specifically protects sensitive data including Social Security numbers, health records, financial account details, and biometric information. Licensees must use multi-factor authentication and maintain security programs to prevent unauthorized access or disclosure of this information.