Consumer Data Protection Act; personal data rights of consumer, etc.

Consumer Data Protection Act. Establishesa framework for controlling and processing personal data in the Commonwealth.The bill applies to all persons that conduct business in the Commonwealthand either (i) control or process personal data of at least 100,000consumers or (ii) derive over 50 percent of gross revenue from thesale of personal data and control or process personal data of at least25,000 consumers. The bill outlines responsibilities and privacyprotection standards for data controllers and processors. The billdoes not apply to state or local governmental entities and containsexceptions for certain types of data and information governed byfederal law. The bill grants consumer rights to access, correct, delete,and obtain a copy of personal data and to opt out of the processingof personal data for the purposes of targeted advertising. The billprovides that the Attorney General has exclusive authority to enforceviolations of the law, and the Consumer Privacy Fund is created tosupport this effort. The bill has a delayed effective date of January1, 2023.