An act relating to data brokers and personal information

The definition of 'business' was narrowed from 'a controller, a consumer health data controller, a processor, or a commercial entity' to simply 'a commercial entity,' removing the broader privacy framework and focusing the bill on data brokers specifically.

Definitions for 'controller' and 'consumer health data controller' were removed entirely, along with associated enforcement provisions that distinguished between controllers/processors licensed with the Department of Financial Regulation versus other entities.

New definitions were added for 'GenAI system' (an AI system that generates synthetic content emulating training data), 'publicly available information' (with exclusions for biometric data collected without knowledge, obscene depictions, genetic data, and nonconsensual intimate images), 'sale' (with specific exclusions for processor disclosures, consumer-directed disclosures, affiliate transfers, consent-based disclosures, publicly available info, and M&A transactions), and 'identified or identifiable individual.'

The definition of 'biometric data' was narrowed by removing the phrase 'that is linked or reasonably linkable to an individual' and replacing it with 'can be used to identify an individual,' making the standard more specific.

'Phone number' was removed from the list of specific data elements that constitute 'brokered personal information.'

New clarifying language was added to the 'data broker' definition stating that a consumer does not have a direct relationship if their purpose is to exercise a consumer right or for identity verification, and that merely collecting information directly from a consumer does not create a direct relationship - the consumer must intend to interact with the business.

The 'processor' definition was changed from 'a person who processes personal data on behalf of a controller' to a broader operational definition covering any manual or automated operations on brokered personal information, including collection, use, storage, disclosure, analysis, deletion, or modification.

A new exception was added to 'personally identifiable information' stating it does not require a consumer's first name or initial and last name if any listed data element alone is sufficient to perform or attempt identity theft against the consumer.

A new section 2431 was added prohibiting acquisition of brokered personal information through fraudulent means and its use for stalking, harassment, fraud, or unlawful discrimination. It also requires data brokers to verify prospective users' identities, review stated purposes, and refuse disclosure when there are reasonable grounds to believe the information will be used illegally.

The notice method requirement was relaxed from requiring 'two or more' methods to allowing 'one or more' methods for breach notification. Telephonic notice now requires at least five attempts to reach the consumer by live conversation before leaving a voicemail.

A new requirement was added that if a data collector notifies more than 1,000 consumers at one time of a security breach, they must also notify all consumer reporting agencies without unreasonable delay.

The five-year lookback period for establishing a 'direct relationship' with a business was removed. Previously, a customer relationship had to be 'within the last five calendar years'; now any past or present customer relationship qualifies.

The definition of 'brokered personal information' was significantly expanded. The old version listed specific data elements (name, address, phone number, etc.). The new version removes phone number as a standalone element but adds a broad catch-all covering 'derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household.' This dramatically widens what counts as brokered personal information.

The definition of 'business' was narrowed. The House version defined it as 'a controller, a consumer health data controller, a processor, or a commercial entity.' The enacted version removes the references to controller, consumer health data controller, and processor, leaving only 'a commercial entity.' Correspondingly, the definitions for 'controller' and 'consumer health data controller' were removed entirely.

A new definition for 'GenAI system' was added, defined as an artificial intelligence system that can generate derived synthetic content (text, images, video, audio) that emulates the structure and characteristics of its training data. A related definition for 'artificial intelligence system' was also included.

The 'direct relationship' concept in the data broker definition was substantially revised. The 5-year lookback period for customers was removed. A new intent-based standard was added: a consumer must have 'intentionally interacted with a business for the purpose of accessing, purchasing, using, requesting, or obtaining information about the business's products or services.' It clarifies that merely collecting data directly from a consumer does not create a direct relationship, and that exercising a consumer right or identity verification does not count.

The definition of 'personally identifiable information' was expanded with a new subdivision (C) stating that PII does not require a consumer's first name or last name if any single data element (SSN, driver license number, financial account number, password/PIN, biometric data, genetic info, or health records) is sufficient to perform or attempt identity theft. This lowers the threshold for what qualifies as PII.

The definition of 'processor' was changed from 'a person who processes personal data on behalf of a controller' to a much broader and more specific definition: 'a person who performs any operation or set of operations, whether by manual or automated means, on brokered personal information or on sets of brokered personal information, such as the collection, use, storage, disclosure, analysis, deletion, or modification of brokered personal information on behalf of a business.'

New definitions were added for 'identified or identifiable individual' (an individual who can be readily identified, directly or indirectly) and 'publicly available information' (information made available through government records or to the general public from widely distributed media, where a data broker has reasonable basis to believe it is publicly available).

The definition of 'biometric data' was narrowed slightly. The House version required data that 'is linked or reasonably linkable to an individual.' The enacted version requires that the data 'can be used to identify an individual,' which is a somewhat higher threshold.

The civil penalty for failing to register as a data broker was increased from $50 per day (capped at $10,000 per year) to an administrative fine of $200 per day with no stated annual cap. The enacted version also adds that the State can recover 'any reasonable costs incurred by the State in the investigation and administration of the action.'

The definition of 'biometric data' was changed from 'that data generated from...can be used to identify an individual' to 'data generated from...that is linked or reasonably linkable to an individual,' making the scope more precise and consistent with modern privacy law language.

New definitions for 'controller' (a person who determines the purpose and means of processing personal data) and 'consumer health data controller' (any controller that determines the purpose and means of processing consumer health data) were added to Section 2430.

The definition of 'business' was expanded to include 'a controller, a consumer health data controller, a processor, or a commercial entity,' broadening which entities fall under the bill's umbrella.

The definition of 'brokered personal information' added 'phone number' as a specific data element (item ix) and replaced the broad catch-all provision referencing 'derived data and unique identifiers...linked or reasonably linkable to an identified or identifiable individual or to a device' with a simpler standard: information that 'would allow a reasonable person to identify the consumer with reasonable certainty.'

The definition of 'processor' was simplified from a detailed list of operations (collection, use, storage, disclosure, analysis, deletion, modification) on brokered personal information to simply 'a person who processes personal data on behalf of a controller.'

The definition of 'GenAI system' (an artificial intelligence system that can generate derived synthetic content including text, images, video, and audio) and the related 'artificial intelligence system' definition were removed entirely.

The definition of 'identified or identifiable individual' was removed.

The detailed definition of 'sale' with its six exceptions (disclosure to processors, for consumer-requested services, to affiliates, with consumer consent, publicly available information, and in mergers/acquisitions) along with the affiliate and control definitions were removed from the official version.

The extensive list of exclusions from 'publicly available information' was removed, including exclusions for biometric data collected without knowledge, consumer profiles, information made available for sale, inferences, obscene visual depictions, combinations of brokered and public data, genetic data, information with reasonable expectation of privacy, and nonconsensual intimate images.

A five-calendar-year lookback period was added to the 'direct relationship' examples for data brokers, so that a customer, client, subscriber, user, or registered user is considered to have a direct relationship only if within the last five calendar years.

Multiple subsections of Section 2435 (Notice of Security Breaches) were removed from the official version, including: detailed notice methods (written, electronic, telephonic with specific requirements), notice to consumer reporting agencies for breaches affecting more than 1,000 consumers, an exception to the notice requirement where misuse is not reasonably possible, a HIPAA compliance safe harbor, a waiver prohibition, and a financial institutions exemption.

The enforcement provisions in Section 2435 were restructured to explicitly grant the Attorney General authority over controllers and processors (not just data collectors), including rulemaking, civil investigations, assurances of discontinuance, and civil actions under chapter 63. The Superior Courts are given jurisdiction over enforcement matters.

The year was corrected from 2026 to 2025, the page count changed from 43 to 74 pages, the header format changed from 'AS PASSED BY HOUSE' to 'BILL AS PASSED BY THE HOUSE,' and the full list of introducing representatives along with committee referral and subject matter were added to the official version.

New Section 2431 prohibits acquiring brokered personal information through fraudulent means and prohibits using it for stalking, harassment, fraud (including identity theft), or unlawful discrimination (employment and housing). Violations are treated as unfair and deceptive acts in commerce.

Data brokers must now maintain procedures requiring prospective users to identify themselves, state the purpose for which information is sought, and certify it will be used for no other purpose. Brokers must verify identity, review stated purposes, and refuse disclosure if there are reasonable grounds to believe the information will be used illegally or outside stated purposes.

A new provision requires data collectors notifying more than 1,000 consumers at one time about a security breach to also notify all nationwide consumer reporting agencies of the timing, distribution, and content of the notice.

The definition of 'brokered personal information' was revised: 'phone number' was removed as a standalone enumerated element, but the catch-all provision was expanded to include 'derived data and unique identifiers' that are 'linked or reasonably linkable' to an individual or to a device identifying individuals in a household.

The definitions of 'controller' and 'consumer health data controller' were removed entirely, and the 'business' definition no longer references them. The 'processor' definition was changed from processing 'personal data on behalf of a controller' to processing 'brokered personal information on behalf of a business.'

New definitions added for 'GenAI system' (an AI system that generates synthetic content emulating training data), 'identified or identifiable individual,' and 'sale' (with detailed carve-outs for processor disclosures, consumer-requested services, affiliate transfers, consent-based disclosures, publicly available information, and M&A transactions).

The 'publicly available information' definition was substantially expanded with new exclusions: biometric data collected without consumer knowledge, collated consumer profiles on websites, information made available for sale, inferences generated from such data, obscene visual depictions, brokered personal information combined with public information, genetic data (unless publicly released by the consumer), website information where the consumer maintained a reasonable expectation of privacy, and nonconsensual intimate images.

The 'data broker' direct relationship examples no longer include the qualifier 'within the last five calendar years,' meaning a broader set of past interactions now counts as a direct relationship that would disqualify a business from being classified as a data broker.

New subdivision added specifying permissible methods for breach notification to consumers: written mail, electronic notice (with anti-phishing warnings and no hypertext links requesting personal information), or telephonic notice (requiring five live contact attempts before leaving voicemail).