Bill > HB351

This bill, known as the Alabama Personal Data Protection Act, establishes regulations for the processing of personal data and grants consumers rights related to their data. It applies to businesses that conduct business in Alabama or target residents of the state and meet certain thresholds, such as processing the personal data of over 25,000 consumers or deriving a significant portion of their revenue from selling personal data. The act defines key terms like "personal data" (information linked to an identifiable individual), "controller" (an entity determining how personal data is processed), and "sale of personal data" (exchanging data for consideration). Consumers are granted rights to confirm if their data is being processed, correct inaccuracies, delete their data, obtain a copy of their data, and opt out of targeted advertising or the sale of their personal data. The bill also outlines specific requirements for controllers, such as limiting data collection, implementing security practices, and providing clear privacy notices, and places obligations on processors to adhere to controller instructions and maintain data security. Various entities and types of data, including protected health information and data related to financial institutions or research, are exempt from these provisions. The Attorney General is empowered to enforce the act, with a process that includes providing notice of violations and a 45-day period for businesses to correct them before civil penalties can be assessed. The act is set to become effective on May 1, 2027.

Business and Industry, Government Affairs

https://alison.legislature.state.al.us/bill-search