Oklahoma HB 1012: Data privacy; Oklahoma Computer Data Privacy Act; consumer protection; civil penalties; effective date.

Bill Text

Req. No. 10067 Page 1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

STATE OF OKLAHOMA

1st Session of the 60th Legislature (2025)

HOUSE BILL 1012 By: West (Josh)

AS INTRODUCED

An Act relating to privacy of computer data; enacting
the Oklahoma Computer Data Privacy Act; defining
terms; providing for applicability of act to certain
businesses that collect consumers' personal
information; providing exemptions; prescribing
compliance with other laws and legal proceedings;
requiring act to be liberally construed to align its
effects with other laws relating to privacy and
protection of personal information; providing for
controlling effect of federal law; providing for
construction in event of conflict with state law;
providing for controlling effect of law which
provides greatest privacy or protection to consumers;
providing for preemption of local law; providing
consumers right to request disclosure of certain
information; providing consumers right to request
deletion of certain information; providing consumers
the right to request and receive a disclosure of
personal information sold or disclosed; providing
consumers right to opt in and out of the sale of
personal information; making legislative findings;
providing contracts or other agreements purporting to
waive or limit a right, remedy or means of
enforcement contrary to public policy; requiring
businesses collecting consumer data information
inform consumer of certain information collected;
prescribing required content of disclosures;
requiring consumer consent; requiring businesses to
provide online privacy policy or a notice of
policies; requiring businesses to designate and make
available methods for submitting verifiable consumer
request for certain information; requiring businesses
receiving verifiable consumer requests reasonably
verify identity of requesting consumer; requiring
businesses disclose required information within a

Req. No. 10067 Page 2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

certain period; requiring businesses using de-
identified information not re-identify or attempt to
re-identify certain consumers; requiring permission;
prohibiting discrimination against consumers for
exercise of rights; authorizing businesses to offer
financial incentives to consumers for collection,
sale or disclosure of personal information;
prohibiting division of single transactions;
requiring employee training with respect to consumer
inquiries; requiring disclosure of certain rights,
requirements and information; providing civil
penalties; authorizing Oklahoma Attorney General to
take certain actions based on violations; authorizing
Attorney General to recover reasonable expenses
incurred in obtaining injunctive relief or civil
penalties; directing Attorney General to deposit
collected penalties in a dedicated account in the
General Revenue Fund; providing certain immunities;
providing protections to service providers; providing
for codification; and providing an effective date.

BE IT ENACTED BY THE PEOPLE OF THE STATE OF OKLAHOMA:
SECTION 1. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.1 of Title 17, unless there
is created a duplication in numbering, reads as follows:
This act shall be known and may be cited as the "Oklahoma
Computer Data Privacy Act".
SECTION 2. NEW LAW A new section of law to be codified
in the Oklahoma Statutes as Section 901.2 of Title 17, unless there
is created a duplication in numbering, reads as follows:
As used in this act:
1. "Aggregate consumer information" means information that
relates to a group or category of consumers from which individual

Req. No. 10067 Page 3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

consumer identities have been removed and that is not linked or
reasonably linkable to a particular consumer or household, including
through a device. The term does not include one or more individual
consumer records that have been de-identified;
2. "Biometric information" means an individual's physiological,
biological or behavioral characteristics that can be used, alone or
in combination with other characteristics or other identifying data,
to establish the individual's identity. The term includes:
a. an image of an iris, retina, fingerprint, face, hand,
palm or vein pattern or a voice recording from which
an identifier template can be extracted such as a
faceprint, minutiae template or voiceprint,
b. keystroke patterns or rhythms,
c. gait patterns or rhythms, and
d. sleep, health or exercise data that contains
identifying information;
3. "Business" means a for-profit entity, including a sole
proprietorship, partnership, limited liability company, corporation,
association or other legal entity that is organized or operated for