Privacy Bill Essentials: Alaska

April 16, 2021
Hinshaw Privacy & Cyber Bytes

A comprehensive data protection and privacy bill (SB 116, HB 159) has been introduced in Alaska. Similar to the California Consumer Privacy Act (CCPA) and other recently proposed state laws, the Alaska Consumer Data Privacy Act (the Act) would give Alaskan consumers more control over their personal information, impose a series of requirements on covered business, and create a limited private right of action. The Act, however, goes even further than the CCPA with respect to the right to know and the right to disclosure by creating a five-year lookback period—as opposed to the 12 months required by CCPA. Additionally, the Act would create a data broker registry. If enacted, it would go into effect on January 1, 2023.

To whom would it apply?

The Act would apply to for-profit businesses that:

What types of information would it cover?

The Act broadly defines personal information to include a consumer's real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number, or passport number. Personal information also includes characteristics of protected classifications under state or federal law, commercial information, biometric data, geolocation data, internet activity, sensory information, and educational data. 

What rights would it create?

The Act would create several consumer rights, including the right to: 

What obligations would it impose?

The Act would require a business that collects personal information from a consumer to notify the consumer, before collecting the information, of the following:

Businesses also would be required to post an online privacy policy that includes:

In addition, businesses would be required to post a "Do Not Collect or Sell My Personal Information" link on their websites.

The Act also would require third-party recipients of consumers' personal information that originated from a business to notify the business upon receipt of that information, provide updated contact information, and honor any deletion requests issued by the consumer to the collecting business. 

How would it be enforced?

The Alaska Department of Law would enforce the Act. Violations would be deemed an "unfair or deceptive act or practice" under Alaskan state law, and could result in fines ranging from $1,000 to $25,000 for each violation.

The Act also would create a limited private right of action for any consumer whose personal information is subjected to "unauthorized access, destruction, use, modification, or disclosure." The Act defines such a violation as an "ascertainable loss of $1 or of an amount proven at trial, whichever is greater." 

Where does it stand?

The Consumer Data Privacy Act was introduced by Governor Mike Dunleavy in both the Senate (SB116) and House (HB159) of the Alaska State Legislature on March 31, 2021. The bills have now been referred to the respective Labor & Commerce Committees.