HB54 Alabama 2020 Session

Existing law does not prohibit any state agency that collects or maintains data containing personal information of an Alabama resident from selling the resident's personal information to a third party

This bill would prohibit a state agency that collects or maintains data containing personal information of an Alabama resident from selling the personal information of an Alabama resident to a third party

Relating to privacy; to prohibit a state agency that collects or maintains data containing personal information of an Alabama resident from selling the personal information of an Alabama resident to a third party.

Section 1

(a) No state agency that collects or maintains data containing personal information of an Alabama resident shall give or sell the personal information of an Alabama resident to a third party. (b) (1) For purposes of this section, personal information shall include all of the following: a. An individual's first name or first initial and last name in combination with any one or more of the following data elements for that individual: 1. A Social Security number. 2. A driver's license or identification card number, passport number, military identification number, or other similar number issued on a government document used to verify identity. 3. A financial account number or credit or debit card number, in combination with any required security code, access code, or password that is necessary to permit access to an individual's financial account. 4. Any information regarding an individual's medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional. 5. An individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual. b. A user name or e-mail address, in combination with a password or security question and answer, that would permit access to an online account. (2) The term does not include any of the following: a. Information about an individual which has been made publicly available by a federal, state, or local governmental entity. b. Information that is encrypted, secured, or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable. c. Information that includes only the last four digits of an individual's Social Security number.

Section 2

This act shall become effective on the first day of the third month following its passage and approval by the Governor, or its otherwise becoming law.