Bill > SB1279

This bill, titled the "Consumer Data Privacy Act," aims to provide consumer data privacy protections in Pennsylvania. The key provisions of the bill include: 1. Granting consumers the right to confirm if their personal data is being processed, correct inaccuracies, delete their personal data, and opt out of certain processing activities like targeted advertising and the sale of their personal data. 2. Imposing duties on controllers (entities that determine the purposes and means of processing personal data) to limit data collection, obtain consent for certain processing, implement security safeguards, and provide consumers with clear privacy notices. 3. Requiring processors (entities that process personal data on behalf of controllers) to assist controllers in complying with consumer rights and to have contracts governing their data processing activities. 4. Mandating that controllers conduct data protection assessments for processing activities that present a heightened risk of harm to consumers. 5. Exempting certain entities and data types from the requirements of the act, such as the Commonwealth, nonprofits, institutions of higher education, and data subject to other federal laws like HIPAA. 6. Granting the Pennsylvania Attorney General exclusive authority to enforce the act, with an initial 60-day cure period for violations before enforcement actions can be taken.