Arizona SB 1614: consumer data; privacy

Bill Text

SB1614 - 542R - I Ver 

 REFERENCE TITLE: consumer data; 
 privacy

 State of 
 Arizona

 Senate

 Fifty-fourth 
 Legislature

 Second Regular 
 Session

 2020

 SB 1614

 Introduced by 

 Senators Bowie: Alston, Bradley, Contreras, Dalessandro, 
 Gonzales, Mendez, Navarrete, Otondo, Peshlakai, Quezada, Rios, Steele

AN ACT

amending title 
18, Arizona Revised Statutes, by adding chapter 7; relating to personal data. 

(TEXT OF BILL BEGINS ON NEXT PAGE)

Be it enacted by the Legislature of the State of Arizona:

Section 1. Title 18, Arizona Revised Statutes, 
is amended by adding chapter 7, to read:

CHAPTER 7

CONSUMER DATA PRIVACY

ARTICLE 1. GENERAL PROVISIONS

START_STATUTE18-701. Consumer data privacy; collection of personal information; 
requirements; civil action; state preemption; definitions

A. A consumer may request that a 
business that collects personal information about the consumer disclose to the 
consumer the following:

1. The categories of personal 
information the business has collected about that consumer.

2. The categories of sources from 
which the personal information is collected.

3. The business or commercial purpose 
for collecting or selling personal information.

4. The categories of third parties 
with whom the business shares personal information.

5. The specific personal information 
the business has collected about that consumer.

B. A business that collects personal 
information about a consumer shall disclose to the consumer the information 
specified in subsection A of this section on receipt of a verifiable request 
from the consumer.

C. This section does not require a 
business to do either of the following:

1. Retain any personal information 
about a consumer collected for a single onetime transaction if, in the ordinary 
course of business, that information about the consumer is not retained.

2. Reidentify or otherwise link any 
data that, in the ordinary course of business, is not maintained in a manner 
that would be considered personal information.

D. A consumer may request that a 
business that sells the consumer's personal information or that discloses 
personal information for a business purpose disclose to that consumer the 
following information:

1. The categories of personal 
information that the business collected about the consumer.

2. The categories of personal 
information that the business sold about the consumer and the categories of 
third parties to whom the personal information was sold by category or 
categories of personal information for each third party to whom the personal 
information was sold.

3. The categories of personal 
information that the business disclosed about the consumer for a business 
purpose.

E. A consumer may request that a 
business delete any personal information about the consumer that the business 
has collected from the consumer. A business that collects personal 
information about consumers shall disclose pursuant to subsection L of this 
section the consumer's rights to request the deletion of the consumer's 
personal information.� A business that receives a verifiable request from a 
consumer to delete the consumer's personal information shall delete the consumers 
personal information from its records and direct any service providers to 
delete the consumer's personal information from their records.� A business or a 
service provider is not required to comply with a consumer's request to delete 
the consumer's personal information if it is necessary for the business or 
service provider to maintain the consumer's personal information in order to:

1. Complete the transaction for which 
the personal information was collected, provide a good or service requested by the 
consumer or reasonably anticipated within the context of a business's ongoing 
business relationship with the consumer or otherwise perform a contract between 
the business and the consumer.

2. Detect security incidents, protect 
against malicious, deceptive, fraudulent or illegal activity or prosecute those 
responsible for that activity.

3. Debug to identify and repair 
errors that impair existing intended functionality.

4. Exercise free speech, ensure the 
right of another consumer to exercise the person's right of free speech or 
exercise another right provided for by law.

5. Engage in public‑reviewed or 
peer‑reviewed scientific, historical or statistical research in the 
public interest that adheres to all other applicable ethics and privacy laws if 
the businesses's deletion of the information is likely to render impossible or 
seriously impair the achievement of the research, if the consumer has provided 
informed consent.

6. Enable solely internal uses that 
are reasonably aligned with the expectations of the consumer based on the 
consumer's relationship with the business.

7. Comply with a legal obligation.

F. A business that sells personal 
information about a consumer or that discloses a consumer's personal 
information for a