WEST virginia legislature

2022 regular session

Introduced

House Bill 4454

By Delegates Reed, Kimes, Nestor, Haynes, Worrell, Mallow, Rowan, Riley, Bates, Jennings and Forsht

[Introduced January 31, 2022; Referred to
the Committee on the Judiciary.]

A BILL to amend the Code of West Virginia, 1931, as amended, by adding thereto a new article, designated §46A-6O-1, §46A-6O-2, and §46A-6O-3, all relating to creating a consumers’ right to limit the sale and sharing of his or her personal information; establishing a consumers’ right to opt-out of any sale or sharing of his or her personal information; creating a consumers’ right of no retaliation following any opt-out or exercise of other rights; and providing for methods of limiting sale, sharing, and use of personal information, as well as any use of sensitive personal information.

Be it enacted by the Legislature of West Virginia:

Article  6O. Consumer right to limit sale and sharing of personal information.

§46A-6O-1. Consumers’ right to opt-out of sale or sharing of personal information.

(a) A consumer shall have the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. This right may be referred to as the right to opt-out of sale or sharing.

(b) A business that sells consumers’ personal information to, or shares it with, third parties shall provide notice to consumers that this information may be sold or shared and that consumers have the “right to opt-out” of the sale or sharing of their personal information.

(c) Notwithstanding subdivision (a) of this section, a business shall not sell or share the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

(d) A business that has received direction from a consumer not to sell or share the consumer’s personal information or, in the case of a minor consumer’s personal information has not received consent to sell or share the minor consumer’s personal information, shall be prohibited from selling or sharing the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer’s personal information.

§46A-6O-2. Consumers’ right of no retaliation following opt-out or exercise of other rights.

(a) (1) A business shall not discriminate against a consumer because the consumer exercised any of the consumer’s rights under this article, including, but not limited to, by:

(A) Denying goods or services to the consumer;

(B) Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;

(C) Providing a different level or quality of goods or services to the consumer;

(D) Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services; or

(E) Retaliating against an employee, applicant for employment, or independent contractor for exercising their rights under this title.

(2) Nothing in this subdivision prohibits a business, pursuant to subdivision (b), from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to the business by the consumer’s data.

(3) This subdivision does not prohibit a business from offering loyalty, rewards, premium features, discounts, or club card programs consistent with this title.

(b) (1) A business may offer financial incentives, including payments to consumers as compensation, for the collection of personal information, the sale or sharing of personal information, or the retention of personal information. A business may also offer a different price, rate, level, or quality of goods or services to the consumer if that price or difference is reasonably related to the value provided to the business by the consumer’s data.

(2) A business that offers any financial incentives pursuant to this subdivision, shall notify consumers of the financial incentives.

(3) A business may enter a consumer into a financial incentive program only if the consumer gives the business prior opt-in consent that clearly describes the material terms of the financial incentive program, and which may be revoked by the consumer at any time. If a consumer refuses to provide opt-in consent, then the business shall wait for at least 12 months before next requesting that the consumer provide opt-in consent.

(4) A business shall not use financial incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

§46A-6O-3. Methods of limiting sale, sharing, and use of personal information; use of sensitive personal information.

(a) A business that sells or shares consumers’ personal information or uses or discloses consumers’ sensitive personal information shall, in a form that is reasonably accessible to consumers:

(1) Provide a clear and conspicuous link on the business’ internet homepages, titled “Do Not Sell or Share My Personal Information”, to an internet web page that enables a consumer, or a person authorized by the consumer, to opt-out of the sale or sharing of the consumer’s personal information;

(2) Provide a clear and conspicuous link on the business’ internet homepages, titled “Limit the Use of My Sensitive Personal Information”, that enables a consumer, or a person authorized by the consumer, to limit the use or disclosure of the consumer’s sensitive personal information;

(3) At the business’ discretion, utilize a single, clearly labeled link on the business’ internet homepages, in lieu of complying with paragraphs (1) and (2), if that link easily allows a consumer to opt-out of the sale or sharing of the consumer’s personal information and to limit the use or disclosure of the consumer’s sensitive personal information; and

(4) In the event that a business responds to opt-out requests received pursuant to paragraph (1), (2), or (3) by informing the consumer of a charge for the use of any product or service, present the terms of any financial incentive offered for the retention, use, sale, or sharing of the consumer’s personal information.

(b) (1) A business shall not be required to comply with subdivision (a) of this section if the business allows consumers to opt-out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism to the business indicating the consumer’s intent to opt-out of the business’ sale or sharing of the consumer’s personal information or to limit the use or disclosure of the consumer’s sensitive personal information, or both.

(2) A business that allows consumers to opt-out of the sale or sharing of their personal information and to limit the use of their sensitive personal information pursuant to paragraph (1) may provide a link to a web page that enables the consumer to consent to the business ignoring the opt-out preference signal with respect to that business’ sale or sharing of the consumer’s personal information or the use of the consumer’s sensitive personal information for additional purposes provided that:

(A) The consent web page also allows the consumer or a person authorized by the consumer to revoke the consent as easily as it is affirmatively provided; and

(B) The link to the web page does not degrade the consumer’s experience on the web page the consumer intends to visit and has a similar look, feel, and size relative to other links on the same web page.

(3) A business that complies with subdivision (a) is not required to comply with subdivision (b). For the purposes of clarity, a business may elect whether to comply with subdivision (a) or subdivision (b).

(c) A business that is subject to this section shall:

(1) Not require a consumer to create an account or provide additional information beyond what is necessary in order to direct the business not to sell or share the consumer’s personal information or to limit use or disclosure of the consumer’s sensitive personal information;

(2) Include a description of a consumer’s rights, along with a separate link to the “Do Not Sell or Share My Personal Information” internet web page and a separate link to the “Limit the Use of My Sensitive Personal Information” internet web page, if applicable, or a single link to both choices, or a statement that the business responds to and abides by opt-out preference signals sent by a platform, technology, or mechanism in accordance with subdivision (b), in:

(A) Its online privacy policy or policies if the business has an online privacy policy or policies; or

(B) Any West Virginia-specific description of consumers’ privacy rights.

(3) Ensure that all individuals responsible for handling consumer inquiries about the business’ privacy practices or the business’ compliance with this title are informed of their rights as consumers and how to exercise their rights;

(4) For consumers who exercise their right to opt-out of the sale or sharing of their personal information or limit the use or disclosure of their sensitive personal information, refrain from selling or sharing the consumer’s personal information or using or disclosing the consumer’s sensitive personal information and wait for at least 12 months before requesting that the consumer authorize the sale or sharing of the consumer’s personal information or the use and disclosure of the consumer’s sensitive personal information for additional purposes, or as authorized by regulations;

(5) For consumers under 16 years of age who do not consent to the sale or sharing of their personal information, refrain from selling or sharing the personal information of the consumer under 16 years of age and wait for at least 12 months before requesting the consumer’s consent again, or as authorized by regulations or until the consumer attains 16 years of age; and

(6) Use any personal information collected from the consumer in connection with the submission of the consumer’s opt-out request solely for the purposes of complying with the opt-out request.

(d) Nothing in this title shall be construed to require a business to comply with this article by including the required links and text on the homepage that the business makes available to the public generally, if the business maintains a separate and additional homepage that is dedicated to West Virginia consumers and that includes the required links and text, and the business takes reasonable steps to ensure that West Virginia consumers are directed to the homepage for West Virginia consumers and not the homepage made available to the public generally.

(e) A consumer may authorize another person to opt-out of the sale or sharing of the consumer’s personal information and to limit the use of the consumer’s sensitive personal information on the consumer’s behalf, including through an opt-out preference signal, as defined in paragraph (1) of subdivision (b), indicating the consumer’s intent to opt-out, and a business shall comply with an opt-out request received from a person authorized by the consumer to act on the consumer’s behalf, pursuant to regulations adopted by the Attorney General regardless of whether the business has elected to comply with subdivision (a) or (b). For purposes of clarity, a business that elects to comply with subdivision (a) may respond to the consumer’s opt-out.

(f) If a business communicates a consumer’s opt-out request to any person authorized by the business to collect personal information, the person shall thereafter only use that consumer’s personal information for a business purpose specified by the business, or as otherwise permitted by this title, and shall be prohibited from:

(1) Selling or sharing the personal information; and

(2) Retaining, using, or disclosing that consumer’s personal information:

(A) For any purpose other than for the specific purpose of performing the services offered to the business;

(B) Outside of the direct business relationship between the person and the business; or

(C) For a commercial purpose other than providing the services to the business.

(g) A business that communicates a consumer’s opt-out request to a person pursuant to subdivision (f) shall not be liable under this title if the person receiving the opt-out request violates the restrictions set forth in the title provided that, at the time of communicating the opt-out request, the business does not have actual knowledge, or reason to believe, that the person intends to commit such a violation. Any provision of a contract or agreement of any kind that purports to waive or limit in any way this subdivision shall be void and unenforceable.

NOTE: The purpose of this bill is to create a consumer right to limit the sale and sharing of his or her personal information. The bill establishes a consumers’ right to opt-out of any sale or sharing of his or her personal information. The bill creates a consumers’ right of no retaliation following any opt-out or exercise of other rights. Finally, the bill provides for methods of limiting sale, sharing, and use of personal information, as well as any use of sensitive personal information.

Strike-throughs indicate language that would be stricken from a heading or the present law and underscoring indicates new language that would be added.