North Carolina SB 757: Appointment of North Carolina Surgeon General.

Bill Text

GENERAL ASSEMBLY OF NORTH CAROLINA
SESSION 2025
S 1
SENATE BILL 757

Short Title: Consumer Privacy Act. (Public)
Sponsors: Senators Salvador, Hanig, and Moffitt (Primary Sponsors).
Referred to: Rules and Operations of the Senate
March 26, 2025
*S757-v-1*
A BILL TO BE ENTITLED 1
AN ACT TO PROTECT CONSUMERS BY ENACTING THE CONSUMER PRIVACY ACT 2
OF NORTH CAROLINA. 3
The General Assembly of North Carolina enacts: 4
SECTION 1. This act shall be known and may be cited as the "North Carolina 5
Consumer Privacy Act." 6
SECTION 2. The General Statutes are amended by adding a new Chapter to read: 7
"Chapter 75F. 8
"Consumer Privacy Act. 9
"§ 75F-1. Definitions. 10
(a) This Chapter shall be known and may be cited as the "North Carolina Consumer 11
Privacy Act." 12
(b) Definitions. – The following definitions apply in this Chapter: 13
(1) Account. – The Consumer Privacy Restricted Account established in 14
G.S. 75F-14. 15
(2) Affiliate. – An entity that (i) controls, is controlled by, or is under common 16
control with another entity or (ii) shares common branding with another entity. 17
(3) Aggregated data. – Information that relates to a group or category of 18
consumers (i) from which individual consumer identities have been removed 19
and (ii) that is not linked or reasonably linkable to any consumer. 20
(4) Air carrier. – As defined in 49 U.S.C. § 40102. 21
(5) Authenticate. – To use reasonable means to determine that a consumer's 22
request to exercise the rights described in G.S. 75F-4 is made by the consumer 23
who is entitled to exercise those rights. 24
(6) Biometric data. – Data generated by automatic measurements of an 25
individual's unique biological characteristics. The term includes an 26
individual's fingerprint, voiceprint, eye retinas, irises, or any other unique 27
biological pattern or characteristic that is used to identify a specific individual. 28
Biometric data does not include any of the following: 29
a. A physical or digital photograph. 30
b. A video or audio recording. 31
c. Data generated from an item described in sub-subdivision a. or b. of 32
this subdivision. 33
d. Information captured from a patient in a health care setting. 34

General Assembly Of North Carolina Session 2025
Page 2 Senate Bill 757-First Edition
e. Information collected, used, or stored for treatment, payment, or health 1
care operations as those terms are defined in 45 C.F.R. Parts 160, 162, 2
and 164. 3
(7) Business associate. – As defined in 45 C.F.R. § 160.103. 4
(8) Child. – An individual younger than 13 years old. 5
(9) Consent. – An affirmative act by a consumer that unambiguously indicates the 6
consumer's voluntary and informed agreement to allow a person to process 7
personal data related to the consumer. 8
(10) Consumer. – An individual who is a resident of this State acting in an 9
individual or household context. The term does not include an individual 10
acting in a commercial or employment context. 11
(11) Control or controlled. – Includes each of the following: (i) ownership of, or 12
the power to vote, more than fifty percent (50%) of the outstanding shares of 13
any class of voting securities of an entity; (ii) control in any manner over the 14
election of a majority of the directors or of the individuals exercising similar 15
functions; and (iii) the power to exercise controlling influence of the 16
management of an entity. 17
(12) Controller. – A person doing business in this State who determines the 18
purposes for which, and the means by which, personal data are processed, 19
regardless of whether the person makes the determination alone or with others 20
that, alone or jointly with others, determines the purpose and means of 21
processing personal data. 22
(13) Covered entity. – As defined in 45 C.F.R. § 160.103. 23
(14) De-identified data. – Data that cannot reasonably be linked to an identified or 24
identifiable individual that are possessed by a controller who does all of the 25
following: 26
a. Takes reasonable measures to ensure that a person cannot associate the 27
data with an individual. 28
b. Publicly commits to maintain and use the data only in de-identified 29
form and not attempt to reidentify the data. 30
c. Contractually obligates any recipients of the data to comply with the 31
requirements described in sub-subdivisions a. and b. of this 32
subdivision. 33
(15) Director. – The Director of the Division. 34
(16) Division. – Consumer Protection Division of the North Carolina Department 35
of Justice or other unit of the Department of Justice engaging in activities 36
under this Chapter. 37
(17) Government entity. – The State or any local political subdivision of the State. 38
(18) Health care facility. – Any entity licensed pursuant to Chapter 122C, 131D, 39
or 131E of the General Statutes or Article 64 of Chapter 58 of the General 40
Statutes, and any clinical laboratory certified under the federal Clinical 41
Laboratory Improvement Amendments in section 353 of the Public Health 42