Revision: May 30, 2024, 3:04 p.m.
HB 1220-FN - VERSION ADOPTED BY BOTH BODIES
7Mar2024... 0415h
7Mar2024... 0793h
05/02/2024 1646s
2024 SESSION
24-2543
11/10
HOUSE BILL 1220-FN
SPONSORS: Rep. Ming, Hills. 35; Rep. Ammon, Hills. 42; Rep. Bay, Straf. 21
COMMITTEE: Judiciary
-----------------------------------------------------------------
AMENDED ANALYSIS
This bill abolishes the collection of racial and educational data for use in a marital application worksheet and further delineates notice requirements and procedures regarding consumer privacy rights.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
7Mar2024... 0415h
7Mar2024... 0793h 24-2543
05/02/2024 1646s
11/10
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand Twenty Four
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 Vital Records; Marriage Registration Form; Race and Education. Amend RSA 5-C:41, III to read as follows:
III. The clerk of the town or city shall complete the following statistical and legal information on the marriage application worksheet for both the bride and groom with information supplied by the bride and groom: the number which represents of the currently intended marriage; if previously married, whether a civil annulment occurred or the marriage ended by death or divorce; the date of civil annulment or that the last marriage ended; [their race and ancestry; their level of education;] any waivers presented by the groom or the bride, either for time or age pursuant to RSA 457:4 through RSA 457:9 or RSA 457:26 and RSA 457:27; whether proof of age of the bride and groom was demonstrated using identification with photograph; if applicable, the divorce decree; and, if applicable, the death record of the former spouse.
2 New Paragraph; Expectation of Privacy; Definitions; Secure and Reliable Means. Amend RSA 507-H:1 by inserting after paragraph XXVII the following new paragraph:
XXVII-a. "Secure and reliable means" are methods, systems, technologies, or processes that are designed to reasonably ensure the protection, integrity, and confidentiality of data or information, and consistently function in a dependable manner. They include, but are not limited to encryption protocols, authentication mechanisms, access controls, redundant systems, and other measures designed to safeguard personal data and ensure consistent performance and reasonable and appropriate physical, technical, organizational, and administrative measures to safeguard and keep personal data confidential.
3 Notice of Application. Amend RSA 507-H:2 to read as follows:
507-H:2 Application.
I. This chapter applies to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state that during a one year period:
(a) Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
(b) Controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25 percent of their gross revenue from the sale of personal data.
II. The secretary of state shall notice and post a link to RSA 507-H on the secretary of state’s website.
4 Consumer Expectation of Privacy; Privacy Notice. Amend RSA 507-H:4, II to read as follows:
II. A consumer may exercise rights under this section by [a] any secure and reliable means [established by the secretary of state and] described to the consumer in the controller's privacy notice. A consumer may designate an authorized agent in accordance with RSA 507-H:5 to exercise the rights of such consumer to opt-out of the processing of such consumer's personal data for purposes of RSA 507-H:4, III(e) on behalf of the consumer. In the case of processing personal data of a known child, the parent or legal guardian may exercise such consumer rights on the child's behalf. In the case of processing personal data concerning a consumer subject to a guardianship, conservatorship, or other protective arrangement, the guardian or the conservator of the consumer may exercise such rights on the consumer's behalf.
5 Notice Format. Amend RSA 507-H:6, III to read as follows:
III. A controller shall provide consumers with a [reasonably accessible], clear and meaningful privacy notice [meeting standards established by the secretary of state that includes] in a reasonably accessible format. The controller may make the notice available online, on accompanying mobile applications, or on a device through which consumers regularly interact with the controller, if applicable. Said notice shall also be reasonably accessible to consumers with disabilities, including through the use of digital accessibility tools. The notice must include the following:
(a) The categories of personal data processed by the controller;
(b) The purpose for processing personal data;
(c) How consumers may exercise their consumer rights, including how a consumer may appeal a controller's decision with regard to the consumer's request;
(d) The categories of personal data that the controller shares with third parties, if any;
(e) The categories of third-parties, if any, with which the controller shares personal data; [and]
(f) An active electronic mail address or other online mechanism that the consumer may use to contact the controller; and
(g) The date the privacy notice was last updated.
6 Controller Responsibilities; Prior Paragraph Reference. Amend RSA 507-H:6, V(a) to read as follows:
V.(a) A controller shall establish, and shall describe in [a] the privacy notice required by paragraph III, [consistent with the requirements of the secretary of state,] one or more secure and reliable means for consumers to submit a request to exercise their consumer rights pursuant to this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests and the ability of the controller to verify the identity of the consumer making the request. A controller shall not require a consumer to create a new account in order to exercise consumer rights, but may require a consumer to use an existing account. Any such means shall include:
(1)(A) Providing a clear and conspicuous link on the controller's Internet website to an Internet webpage that enables a consumer, or an agent of the consumer, to opt-out of the targeted advertising or sale of the consumer's personal data; and
(B) Not later than January 1, 2025, allowing a consumer to opt-out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent, by a platform, technology, or mechanism to the controller indicating such consumer's intent to opt-out of any such processing or sale. Such platform, technology, or mechanism shall:
(i) Not unfairly disadvantage another controller;
(ii) Not make use of a default setting, but, rather, require the consumer to make an affirmative, freely given, and unambiguous choice to opt-out of any processing of such consumer's personal data pursuant to this chapter;
(iii) Be consumer-friendly and easy to use by the average consumer;
(iv) Be as consistent as possible with any other similar platform, technology or mechanism required by any federal or state law or regulation; and
(v) Enable the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt-out of any sale of such consumer's personal data or targeted advertising.
(2) If a consumer's decision to opt-out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent in accordance with RSA 507-H:6, V(a)(1)(A) conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's bona fide loyalty, rewards, premium features, discounts, or club card program, the controller shall comply with such consumer's opt-out preference signal, but may notify such consumer of such conflict and provide to such consumer the choice to confirm such controller-specific privacy setting or participation in such program.
7 Effective Date. This act shall take effect at 12:01 a.m. on January 1, 2025.
24-2543
Amended 5/21/24
HB 1220-FN- FISCAL NOTE
AS AMENDED BY THE SENATE (AMENDMENT #2024-1646s)
FISCAL IMPACT: [ X ] State [ ] County [ ] Local [ ] None
|
| |||||
Estimated State Impact - Increase / (Decrease) | ||||||
| FY 2024 | FY 2025 | FY 2026 | FY 2027 | ||
Revenue | $0 | $0 | $0 | $0 | ||
Revenue Fund(s) | None | |||||
Expenditures | $0 | ($75,000) | $0 | $0 | ||
Funding Source(s) | General Fund | |||||
Appropriations | $0 | $0 | $0 | $0 | ||
Funding Source(s) | None | |||||
• Does this bill provide sufficient funding to cover estimated expenditures? [X] N/A • Does this bill authorize new positions to implement this bill? [X] N/A | ||||||
METHODOLOGY:
This bill abolishes the collection of racial and educational data for use in a marital application worksheet and will have no fiscal impact on expenditures as the Department of State can absorb the cost into their existing budget. Additionally, the bill reduces certain requirement of the Secretary of State in RSA 507-H, Expectations of Privacy. The Department of State indicates removing the requirement for rule making on certain definition and standards in RSA 507-H would reduce the need to hire a consultant and will result in the savings of $75,000 of General Fund expenditures in FY 2025.
AGENCIES CONTACTED:
Department of State