Senate Institutions continues walk-through of S.71, focusing on data‑protection assessments, de‑identified data and enforcement

The Senate Institutions Committee on Friday, Feb. 8 continued its line‑by‑line review of S.71, examining sections 24.21–24.24 that require data‑protection assessments for processing judged to present a high risk of consumer harm, set rules for the use and disclosure of de‑identified data, clarify duties and exemptions for controllers and processors, and establish enforcement procedures that include a limited private right of action.

Rick Sagal, Office of Legislative Counsel, told the committee the bill requires "a controller shall conduct and document what's called a data protection assessment for each of their activities that presents a heightened risk of harm to a consumer," and then defines what the bill considers a high risk of harm. Sagal listed categories that trigger an assessment, including targeting advertising, the sale of personal data, profiling that creates a "reasonably foreseeable risk" of unfair or unlawful disparate treatment, and processing that could cause "financial, physical, or vocational injury" or other substantial consumer harms.

The bill would require an assessment to identify categories of personal data processed, the purposes of processing, whether data are transferred to third parties, and to weigh benefits of the processing "to the controller, the consumer, other stakeholders, and the public" against potential risks. Sagal said controllers must consider…