Bill > SB1815

This bill establishes new regulations for how businesses, referred to as "controllers," handle the personal data of Arizona consumers. It defines key terms like "personal data" (information linked to an identifiable person), "sensitive data" (which includes race, health, and precise location), and "sale of personal data" (sharing data for monetary or valuable consideration). Consumers will have the right to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and the sale of their data. Controllers must authenticate consumer requests, respond within specific timeframes, and provide an appeals process. They are also required to limit data collection to what is necessary, protect data security, and provide a clear privacy notice explaining their data practices. The bill prohibits discrimination against consumers who exercise their rights and requires data protection assessments for certain high-risk processing activities. It also outlines duties for "processors," who handle data on behalf of controllers, and establishes that contracts between them must clearly define their responsibilities. Violations can lead to civil penalties enforced by the Attorney General, with a chance for businesses to "cure" violations before legal action is taken, though there is no private right for individuals to sue under this law.

Government Affairs

https://apps.azleg.gov/BillStatus/BillOverview/85485