Senate Institutions continues walkthrough of S.71 consumer data privacy bill

The Senate Institutions Committee continued its line-by-line review Friday of S.71, “An act relating to consumer data privacy and online surveillance,” focusing on duties the draft law would impose on data controllers and processors.

The committee’s legislative counsel, Rick Sagal of the Office of Legislative Counsel, told members the bill would require controllers to “limit collections and processing of personal data” to what is reasonably necessary to provide a requested product or service, to maintain appropriate security practices, and to delete data according to a retention schedule when it is no longer necessary or when law requires removal.

Sagal said the bill would bar controllers from processing sensitive data except where “strictly necessary” to provide a requested product or service and would prohibit the sale of sensitive data. He also highlighted provisions aimed at minors: a controller that knows or “should have known” a consumer is a minor must take extra care to avoid high risk of harm, must give a conspicuous signal before…