Amendment ID: S2608-56

Amendment 56

Enforcing Sensitive Data Sale Prohibition

Ms. Rausch, Ms. Kennedy, Ms. Miranda, Ms. Jehlen, Messrs. Eldridge and Montigny, Ms. Edwards and Messrs. Brady, Gómez, Keenan and Collins move that the proposed new draft be amended in section 1 by striking out, in lines 649-650, the words “Notwithstanding sections 9 and 11 of said chapter 93A, the attorney general shall have exclusive authority to” and inserting in place thereof the following words:- "The attorney general, or any consumer whose sensitive data is sold in violation of section 5 of this chapter by an entity other than a small business, may"; and

In said section 1 by adding, after line 677, the following paragraph:-

(e) For purposes of paragraph (b) of this section, the term “small business” shall mean a controller or processor that, for the period of the 3 preceding calendar years or for the period during which the controller or processor has been in existence if such period is less than 3 years: (i) had annual gross revenues not exceeding $20,000,000; (ii) on average, did not annually collect, process, retain, or transfer the personal data of more than 200,000 individuals during the period for any purpose other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product; and (iii) did not transfer personal data to a third party in exchange for revenue or other valuable consideration, except for purposes of initiating, rendering, billing for, finalizing, completing, or otherwise collecting payment for a requested service or product.