Bill > SB110

This bill establishes rules for how broadband internet access service providers, which are companies providing internet service to the public, can use customer data. It defines "customer personal information" broadly to include details like communication content, personal characteristics, device identifiers, financial information, and more, but excludes "aggregate customer personal information datasets," which are anonymized and combined data that cannot be linked to individuals. Generally, providers cannot use, disclose, sell, or allow access to this personal information without the customer's explicit "opt-in consent," meaning the customer must actively agree after being properly informed. This consent mechanism must be clear, easy to use, and free of charge, and customers can revoke it at any time without penalty, meaning providers cannot refuse service or charge more based on consent decisions. However, providers can use or share this information without consent for essential service provision, legal compliance, billing, fraud prevention, and in emergency situations to provide location information to authorities, hospitals, or designated family members or guardians. Providers are also allowed to use customer data for marketing their own communications-related services if the customer is given the option to opt out. The bill requires providers to implement reasonable security measures to protect customer data and to notify customers about their data practices and rights, including any significant changes to these practices. Providers are also required to disclose customer personal information upon a customer's written request to a person designated by the customer.

Business and Industry, Government Affairs

https://sdlegislature.gov/#/Session/Bill/26810