Amendment SA1-SB642

LRBa0848/1

MDE:cdc

2023 - 2024 LEGISLATURE

SENATE AMENDMENT 1, TO SENATE BILL 642

December 12, 2023 - Offered by Senator Quinn.

SB642-SA1,1,1 At the locations indicated, amend the bill as follows:

SB642-SA1,1,2 1. Page 3, line 1: delete “134.985" and substitute “100.75".

SB642-SA1,1,3 2. Page 3, line 2: delete “134.985" and substitute “100.75".

SB642-SA1,1,5 3. Page 3, line 12: after “rights" insert “, or is an individual with authority to exercise such rights of a consumer,".

SB642-SA1,1,7 4. Page 3, line 17: after “therefrom" insert “unless such data is generated to identify a specific individual".

SB642-SA1,1,9 5. Page 4, line 4: after “action." insert ““Consent” does not include any of the following:

SB642-SA1,1,12 1. Acceptance of a general terms-of-use document or similar document that contains descriptions of personal data processing along with other, unrelated information.

SB642-SA1,2,1 2. Hovering over, muting, pausing, or closing a given piece of content.

SB642-SA1,2,2 3. Agreements obtained by using dark patterns.".

SB642-SA1,2,3 6. Page 4, line 12: after that line insert:

SB642-SA1,2,6 “(jd) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.”.

SB642-SA1,2,9 7. Page 4, line 21: after “indirectly" insert “, in particular by reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier".

SB642-SA1,2,10 8. Page 6, line 14: after “monetary" insert “or other valuable".

SB642-SA1,2,11 9. Page 6, line 20: after that line insert:

SB642-SA1,2,14 “2m. The disclosure of personal data based on the consumer directing the controller to disclose the personal data or intentionally using the controller to interact with a 3rd party.”.

SB642-SA1,2,15 10. Page 7, line 12: after “obtained" insert “or inferred".

SB642-SA1,2,16 11. Page 8, line 5: after “consumer" insert “or a consumer's authorized agent".

SB642-SA1,2,21 12. Page 9, line 3: after “consumer." insert “A consumer may exercise the consumer's rights through user-enabled global privacy controls, such as a browser plugin or privacy setting, device setting, or other mechanism, that communicate or signal the consumer's choice to opt out of processing for the purpose of targeted advertising or sale of the consumer's personal data.".

SB642-SA1,2,22 13. Page 10, line 21: delete “attorney general" and substitute “department".

SB642-SA1,3,2 14. Page 11, line 18: delete the material beginning with “the consumer" and ending with “sub. (2) (a) 5. or" on line 19.

SB642-SA1,3,5 15. Page 12, line 25: after “account." insert “A controller that recognizes signals approved by other states shall be considered in compliance with this paragraph. Such means shall include all of the following:

SB642-SA1,3,8 1. A clear and conspicuous link on the controller's website to a webpage that enables a consumer or an agent of a consumer to opt out of the targeted advertising or sale of the consumer's personal data.

SB642-SA1,3,13 2. On or after July 1, 2026, an opt-out preference signal sent, with a consumer's consent, by a platform, technology, or mechanism to the controller indicating the consumer's intent to opt out of any processing of the consumer's personal data for the purpose of targeted advertising or sale of the consumer's personal data. Such platform, technology, or mechanism shall do all of the following:

SB642-SA1,3,14 a. Not unfairly advantage one controller over another.

SB642-SA1,3,16 b. Require the consumer to make an affirmative and unambiguous choice to opt out of any processing of the consumer's personal data.

SB642-SA1,3,17 c. Be easy to use by the average consumer.

SB642-SA1,3,20 d. Enable the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt out of any targeted advertising or sale of the consumer's personal data.”.

SB642-SA1,3,21 16. Page 15, line 1: after “shall" insert “regularly".

SB642-SA1,3,22 17. Page 15, line 17: after that line insert:

SB642-SA1,3,24 “6. The processing of personal data related to any good, service, or product feature likely to be accessed by a child.”.

SB642-SA1,4,2 18. Page 16, line 3: on lines 3, 5 and 7, delete “attorney general" and substitute “department".

SB642-SA1,4,4 19. Page 16, line 3: delete the material beginning with “a civil" and ending with “under" on line 4.

SB642-SA1,4,5 20. Page 16, line 4: delete “(a)".

SB642-SA1,4,7 21. Page 16, line 6: delete the material beginning with “attorney" and ending with “general" on line 7 and substitute “department”.

SB642-SA1,4,8 22. Page 16, line 11: delete “attorney general" and substitute “department".

SB642-SA1,4,10 23. Page 22, line 3: after “society," insert “entity regulated by the federal Farm Credit Administration,".

SB642-SA1,4,13 24. Page 23, line 23: after “et seq." insert “and the information is not collected, maintained, disclosed, sold, communicated, or used except as authorized by the federal Fair Credit Reporting Act.".

SB642-SA1,4,15 25. Page 24, line 17: delete the material beginning with that line and ending with page 25, line 23, and substitute:

SB642-SA1,4,17 “(9) Violations. (a) The department and the department of justice shall have authority to enforce violations of this section.

SB642-SA1,5,2 (b) 1. The department or the department of justice shall, at least 30 days before initiating any action under this section, provide a controller or processor written notice that identifies the specific provisions of this section the department or the department of justice alleges have been or are being violated. If within the 30 days the controller or processor cures the noticed violation and provides the department or the department of justice an express written statement that the alleged violations have been cured and that no such further violations shall occur, no action shall be initiated against the controller or processor.

SB642-SA1,5,6 2. Notwithstanding subd. 1., if a controller or processor continues to violate this section in breach of an express written statement provided to the department or the department of justice under subd. 1., the department or the department of justice may initiate an action under this section.

SB642-SA1,5,8 (c) Nothing in this section shall be construed as providing the basis for, or being subject to, a private right of action to violations of this section or under any other law.

SB642-SA1,5,21 (10) Enforcement; penalties. (a) The department or the department of justice has exclusive authority to enforce violations of this section. The department or the department of justice may commence an action in any court of competent jurisdiction in the name of this state to restrain by temporary or permanent injunction the violation of this section and any order issued under this section and to recover a civil forfeiture of not less than $100 and not more than $10,000 for each violation of this section or of any order, including an injunction, issued under this section. The court may in its discretion, prior to the entry of final judgment, make such orders or judgments as may be necessary to restore any person any pecuniary loss suffered because of the acts or practices involved in the action, provided proof thereof is submitted to the satisfaction of the court. The department may use its authority in ss. 93.14 and 93.15 to investigate violations of this section and any order issued under this section.

SB642-SA1,6,4 (b) The department of justice may issue a civil investigative demand to any controller or processor believed to be engaged in, or about to engage in, any violation of this section, and by the civil investigative demand the department of justice may compel the attendance of any officers or agents of the controller or processor, examine the officers or agents of the controller or processor under oath, require the production of any books or papers that the department of justice deems relevant or material to the inquiry, and issue written interrogatories to be answered by the officers or agents of the controller or processor.

SB642-SA1,6,12 (c) The department or the department of justice may serve a complaint, notice, order, civil investigative demand, or other process in the manner provided for service of a summons, or a subpoena as provided by s. 885.03, and either may be served by registered mail to an address that the controller or processor previously furnished to the department, the department of justice, or the department of financial institutions. Service may be proved by affidavit. Service in any event may also be by registered mail addressed to the controller or processor and proved by post office return receipt, in which case the time of service is the date borne by the receipt.

SB642-SA1,6,16 (d) Notwithstanding s. 814.04 (1), the department or the department of justice may recover reasonable expenses incurred in investigating, preparing, and prosecuting the case, including attorney fees, of any action initiated under this section.”.