Bill > HB638

This bill regulates data brokers—businesses that knowingly collect and sell personally identifiable information (meaning information that identifies or can be linked to a specific consumer, such as names, addresses, biometric data, and geolocation) from consumers with whom they do not have a direct relationship—by establishing strict operational, security, and registration requirements beginning July 1, 2027. Specifically, the legislation prohibits anyone from acquiring personally identifiable information through fraudulent means or using it for malicious purposes such as stalking, harassment, fraud, identity theft, or unlawful employment and housing discrimination. Additionally, data brokers must develop and maintain a comprehensive information security program featuring administrative, physical, and technical safeguards like user authentication protocols, firewalls, and employee training. Starting December 1, 2027, data brokers operating in the Commonwealth must also register annually with the Secretary of the Commonwealth by paying a $1,000 fee and disclosing detailed information regarding their data collection practices, security breaches, and whether they share data with government agencies or artificial intelligence developers. The Attorney General is granted exclusive authority to enforce these provisions, allowing them to seek injunctions and civil penalties of up to $7,500 per violation after providing a 30-day notice to cure, while individuals are not permitted to file private lawsuits under the law.