A comprehensive data protection and privacy bill (SB 116, HB 159) has been introduced in Alaska. Similar to the California Consumer Privacy Act (CCPA) and other recently proposed state laws, the Alaska Consumer Data Privacy Act (the Act) would give Alaskan consumers more control over their personal information, impose a series of requirements on covered business, and create a limited private right of action. The Act, however, goes even further than the CCPA with respect to the right to know and the right to disclosure by creating a five-year lookback period—as opposed to the 12 months required by CCPA. Additionally, the Act would create a data broker registry. If enacted, it would go into effect on January 1, 2023.

To whom would it apply?

The Act would apply to for-profit businesses that:

• Do business in Alaska;
• Collect or have collected consumers' personal information, or is the entity on behalf of which the information is collected;
• Determine the purpose and means of processing consumer personal information alone or jointly with others; and

• Meet at least one of the following thresholds:

• 1. Have an annual revenue of at least $25 million
  2. Bought or disclosed the personal information of 100,000 consumers within the most recent calendar year
  3. Sold the personal information of a consumer, household, or device within the past 365 days

What types of information would it cover?

The Act broadly defines personal information to include a consumer's real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number, or passport number. Personal information also includes characteristics of protected classifications under state or federal law, commercial information, biometric data, geolocation data, internet activity, sensory information, and educational data.

What rights would it create?

The Act would create several consumer rights, including the right to:

• Request disclosure of the categories and specific pieces of personal information collected over the past five years;
• Request deletion of personal information;
• Request disclosure of information sold or disclosed for a business or commercial purpose; and
• Opt-out (or for a minor, to opt-in).

What obligations would it impose?

The Act would require a business that collects personal information from a consumer to notify the consumer, before collecting the information, of the following:

• Categories of personal information that will be collected;
• Specific purposes for which each category of personal information will be used; and
• The consumer's right to opt-out of the sale of the consumer's personal information and use of the consumer's precise geolocation data. A business may not collect an additional category of personal information or use collected personal information for an additional purpose without first notifying the consumer.

Businesses also would be required to post an online privacy policy that includes:

• Any Alaska-specific consumer privacy rights;
• The designated methods by which a consumer may request access or deletion of their personal information;
• The categories of personal information the business collected, sold, or disclosed within the preceding twelve months;
• The categories of sources from which the consumer personal information was collected;
• A description of the business or commercial purpose for which each category of consumer personal information was collected, sold, or disclosed;
• The categories of third parties to which the business sold or disclosed consumer personal information; and
• A description of a consumer's right to request specific pieces of consumer's personal information that the business collected.

In addition, businesses would be required to post a "Do Not Collect or Sell My Personal Information" link on their websites.

The Act also would require third-party recipients of consumers' personal information that originated from a business to notify the business upon receipt of that information, provide updated contact information, and honor any deletion requests issued by the consumer to the collecting business.

How would it be enforced?

The Alaska Department of Law would enforce the Act. Violations would be deemed an "unfair or deceptive act or practice" under Alaskan state law, and could result in fines ranging from $1,000 to $25,000 for each violation.

The Act also would create a limited private right of action for any consumer whose personal information is subjected to "unauthorized access, destruction, use, modification, or disclosure." The Act defines such a violation as an "ascertainable loss of $1 or of an amount proven at trial, whichever is greater."

Where does it stand?

The Consumer Data Privacy Act was introduced by Governor Mike Dunleavy in both the Senate (SB116) and House (HB159) of the Alaska State Legislature on March 31, 2021. The bills have now been referred to the respective Labor & Commerce Committees.