May 29 – HARRISBURG – A proposed Pennsylvania law would provide state residents with greater control over accessing personal data collected by online businesses, reviewing the information, requesting its deletion and opting out of further collection.
House Bill 2202, the Consumer Data Protection Act, would apply to large data collection companies – those that generate revenue of at least $20 million a year, or that trade the personal data of at least 100,000 consumers, or generate at least half of the annual revenue from consumer data sales.
Affiliates of those companies would also be subject to regulation under the proposal, which was introduced in December by State Rep. Robert Mercuri of R-Allegheny County.
The bill went to a public hearing on Wednesday before the Pennsylvania House Consumer Affairs Committee. During the hearing, Mercuri called consumer data “the new oil in our economy.”
“It’s mined for its value and it’s sold to advertisers for the benefit of big tech companies,” Mercuri said during the testimony hearing.
Ryan Harkins, senior director of public policy at Microsoft, said the tech giant supported the measure in lieu of a comprehensive federal privacy law. These laws, as proposed by Mercuri, are “critical” to the long-term health and interests of all parties involved: the tech industry, the public, and the online ecosystem.
“The language of the bill is strong. We encourage you to avoid any effort others may make to restrict these important rights,” Harkins said during the hearing of evidence.
Mercuri’s memo on the bill cites personal information such as names and addresses, geolocation from digital devices, social security and driver’s license numbers, and biometric information such as fingerprints and retina scans.
Personal data does not include data that is legally available in public records or that is collected in the aggregate and is not identifiable.
The attorney general’s office would be responsible for enforcing the proposed law, which provides for civil penalties of up to $2,500 for each unintentional violation and $7,500 for each intentional violation.
The bill’s proposed restrictions on data collection would not apply when “all aspects of such business conduct” occur outside of Pennsylvania – the company operates entirely out of state, selling data took place beyond the borders of Pennsylvania and none of the information collected was collected while the consumer was in the state.
There are also exceptions for litigation and criminal investigations, prevention of fraud or harassment, and simply when a consumer requests a product or service, including loyalty or rewards programs.
The proposal does not come without expressed concerns.
The Pennsylvania Retailers’ Association said in written testimony that language aimed at preventing discrimination against those who opt out of data collection could prevent the benefits of loyalty and rewards programs.
The DNA Protection Coalition has called for amendments to regulate biometric data and genetic data separately, saying the former can be used to immediately identify an individual.
The Pennsylvania Chamber of Commerce and Industry has expressed support for uniform federal regulations and that patchwork privacy laws at the state level risk increasing costs for out-of-state employers. state up to $112 billion a year, including $20 billion to $23 billion for small businesses.
Quest Diagnostics, a clinical laboratory, the Pennsylvania Bankers Association and the Pennsylvania Federation of Insurance have each requested exemptions for entities already subject to various federal privacy rules.
Insurance companies use consumer data to underwrite and assess risk, pay claims and serve policyholders, said Jonathan Greer, president of the Insurance Federation of PA, during the hearing of evidence. He added that exemptions should be considered for not-for-profit entities.
“We don’t sell or monetize personal information. That’s not what we do. That’s not our intention,” Greer said.
(c)2022 The Daily Article (Sunbury, PA)
Visit The Daily Item (Sunbury, Pennsylvania) at www.dailyitem.com
Distributed by Tribune Content Agency, LLC.