Bill > HB807

This bill aims to prohibit the sale of sensitive personal data for profit by amending existing Ohio Revised Code sections and enacting a new one. Specifically, it defines "sensitive data" to include information like date of birth, social security number, immigration status, and facial recognition data, and clarifies that "personal information" now encompasses this sensitive data. The core provision, found in the newly enacted section 1347.072, prevents state agencies, officials, data brokers, and private entities from selling or sharing sensitive data with data brokers or other private entities for profit, unless the data is used for a "permitted use" (such as credit evaluation, employment, child support enforcement, or in response to a court order), or if the individual gives informed consent, or if required by law. The bill also establishes penalties for violations, allowing individuals harmed by the unlawful sale or misuse of their sensitive data to pursue civil action for damages, including statutory damages, actual damages, and attorney's fees, with increased penalties for obtaining data under false pretenses. Furthermore, it makes violations of the new section a felony of the fourth degree for repeat offenders.