New Hampshire Senate Bill 255 is about to become the 14th comprehensive U.S. state privacy law enacted after the state legislature finally passed it on January 18. State legislators adjourned at the end of 2023 to allow SB 255 to move swiftly when the 2024 Legislative Session opens on January 3.
The bill still requires the involvement and subsequent action of Governor Chris Sununu. Once enacted, SB 255 will enter into force on January 1, 2025.
State Senators Sharon Carson and Donna Soucy steered the bipartisan bill through committee discussions and stakeholder debates after it was introduced on Jan. 19, 2023. Soucy was interviewed by IAPP in an exclusive interview about how state legislators got their hands on the final draft of SB 255, the bill's expected impact, and more.
joe duball
SB 255 includes many of the foundational or consistent provisions found in all enacted state comprehensive privacy laws. Some call it a "network" of the law, while others see it more as a "patchwork". How much attention or priority do people have in a developing network?
donna soucy
The easiest solution for businesses to work together is at the federal level, but we've noticed that people in New Hampshire and other states want to make sure their information is kept private.
We mainly looked at Connecticut, but we also looked at the model in Virginia. Eventually,We're coming up with results that are close to [those enacted by other states], but that's a specific solution for New Hampshire."
How did you reach your unique coverage threshold?
The focus is actually on the smaller state populations. We're smaller than many of the other states we're looking at.
But beyond that, there are a lot of small businesses and entrepreneurs in our state. The customer record of 35000 is still very important.
The Attorney General's Office has full authority to implement the Act. Representatives of the office made it clear at two committee hearings that the office could not properly enforce the bill, and even said that the private right to act would be more effective and a better solution. Has there been any change on this statement?
As part of the budget process, the Senate has added resources to the Justice Department's Consumer Protection and Antitrust Bureau to investigate and enforce privacy and security of personal information and data privacy rights. The Consumer Protection Division received an additional $1 million in settlement funds to pay for an attorney, a paralegal and an investigator.
How to learn fullyPersonal privacy compliance？LearnCIPP E courseIt focuses on the practical application of privacy laws and regulations, and understands the knowledge and assessment of European data protection and European regulators.
It's well thought out and shows how we want them to use the money. I think this has made it very clear that this is a specific purpose.
Despite the testimonies, I believe that the resources provided will ultimately allow them to focus their efforts and be properly staffed. I believe what (New Hampshire Attorney General John Formeira) said in the budget discussion. With the right resources, which the bill can enforce, he said, those resources can provide the focus and priorities needed.
There is a rulemaking clause under the Secretary of State's office. Unlike the rule-making bodies in California and Colorado, the topics that these rules will cover are predetermined. Can you outline what this rule enacts and what it intends?
The main purpose is to set standards for the privacy statement issued by the data controller to customers.
I receive regular notifications with credit card statements in the smallest font size possible, as needed. This is to try to develop some standards that will draw the attention of the industry to what they need to inform consumers.
This will be a new law. We don't just need to educate controllers and processorsand let the public know that there is a tool that they can use to see where information has been saved, corrected, and deleted, if necessary.
The 60-day period is a shared provision with other states, but the one-year limit on broad rights represents a more delicate issue. What is the idea behind the broad-based ** clause?
This was one of the compromises reached with the House of Representatives. We are satisfied that this ** is permanent.
This is a very strong feeling (in the House of Representatives). We don't want this legislation to be punitive for businesses trying to do the right thing, but the House thinks it's more like because businesses should know what they're doing a year later.
A year after the law was enacted, there are new businesses that will go live within 250 days. We want to give them a little more time to keep up.
The wording in the bill could be interpreted as a right of first refusal loophole, stating that companies will "comply with regulations that provide a greater degree of privacy protection for individuals" when compliance conflicts arise. Is this potential non-pre-first purchase clause intentional or organic?
This is part of the negotiations with industry. The law itself will be an ongoing debate and efforts will be made in the future, but there will be some discussion before a bill can be passed by a voice vote. Part of these talks is the recognition that highly regulated industries want to be clear that what they are already happy to deal with will be their (departmental) federal laws.
Helping companies understand this will be part of the work done by the Attorney General, including the initial remedial period. They will help solve these problems. The idea is not for punishment, but for education. Once this is done, consumers can turn to if the company does not comply with the standards we have set.
The inclusion of a universal opt-out mechanism in the comprehensive state privacy bill is becoming more of a standard than an outlier. Is UOOM a sticking point in the drafting process?
New Hampshire recently passed a constitutional amendment on privacy, and there have been some very ardent advocates for personal privacy in the legislature. These factors alone make incorporation a logical step.
There is no doubt that there is a coalition of employers and ** groups at the negotiating table to try to resolve this issue. Any good legislation will have everyone discuss it that way, and that requires a certain level of compromise. What we ended up with wasn't perfect legislation, but it was the best legislation that New Hampshire and its consumers could see.
Artificial intelligence is currently one of the hottest topics in federal and state legislators. This bill covers this slightly in the language of automated decision-making technologies, mainly in relation to targeted advertising. Will AI regulation bring more beyond the initial future explorations?
We have to start somewhere, and I think that's where we start to move on to AI. We have an important piece of legislation, but AI is evolving so fast that I'm sure we'll be tackling it again in the coming years.
Some of the conversations revolve around ad bombardment, which many consumers are bothered by, but there are also examples of anecdotes about political ads. It's really dangerous and can trick some people into believing things that aren't true at all or aren't based on facts.
But again, there is a clear recognition that we need to do more as the use of AI evolves into many other industries and platforms.
Study Notes Qualification Assessment If you have any doubts, please leave a message, and you can get "information" by following it, and you can get 1 chance of qualification assessment for free.