Bill > A09642

This bill establishes new regulations for "data brokers," which are businesses that knowingly collect and sell personal information of consumers with whom they don't have a direct relationship or collect information outside of the consumer-facing interaction. Key provisions include requiring data brokers to register with the Attorney General, pay a registration fee, and disclose specific information about their data collection and sharing practices, including whether they collect data from minors, sensitive personal information, or share data with foreign actors or law enforcement. The bill also mandates the creation of a centralized data deletion mechanism, allowing consumers to request the removal of their personal information from all registered data brokers through a single verifiable request, with data brokers required to comply within 45 days. Furthermore, data brokers must implement comprehensive information security programs to protect consumer data and will be subject to audits by independent third parties every three years. The bill outlines penalties for violations, including daily civil penalties for failing to register, delete data, or comply with disclosure requirements, and allows for injunctive relief. Certain entities, such as those covered by HIPAA or involved in specific research, are exempt from these regulations.