AN ACT TO CREATE THE MISSISSIPPI CONSUMER PRIVACY PROTECTION ACT; TO DEFINE TERMS; TO PROVIDE THAT THIS ACT APPLIES TO CERTAIN PERSONS CONDUCTING BUSINESS WITHIN THE STATE THAT EXCEEDS TWENTY-FIVE MILLION DOLLARS IN REVENUE; TO EXEMPT CERTAIN PERSONS AND CERTAIN DATA FROM THIS ACT; TO GRANT CONSUMERS THE RIGHT TO REQUEST A CONTROLLER OF THE CONSUMER'S PERSONAL INFORMATION TO GRANT ACCESS TO, CORRECT INACCURACIES IN, DELETE OR OPT OUT OF THE PROCESSING OF SUCH PERSONAL INFORMATION; TO PROVIDE THAT A CONSUMER MAY INVOKE THE CONSUMER RIGHTS GRANTED UNDER THIS ACT AT ANY TIME BY SUBMITTING A REQUEST TO A CONTROLLER OF PERSONAL INFORMATION; TO REQUIRE A CONTROLLER TO RESPOND TO A CONSUMER WITHIN AT LEAST FORTY-FIVE DAYS; TO REQUIRE A CONTROLLER TO ESTABLISH AN APPEAL PROCESS FOR A CONSUMER TO APPEAL THE CONTROLLER'S REFUSAL TO TAKE ACTION AS REQUESTED BY THE CONSUMER; TO REQUIRE A CONTROLLER TO ADOPT AND IMPLEMENT REASONABLE ADMINISTRATIVE, TECHNICAL AND PHYSICAL DATA SECURITY PRACTICES TO PROTECT THE CONFIDENTIALITY, INTEGRITY AND ACCESSIBILITY OF PERSONAL INFORMATION; TO REQUIRE THE CONTROLLER TO PROVIDE CONSUMERS WITH A REASONABLY ACCESSIBLE, CLEAR AND MEANINGFUL PRIVACY NOTICE, WHICH SHALL INCLUDE THE METHODS BY WHICH A CONSUMER CAN REQUEST TO EXERCISE THE RIGHTS GRANTED UNDER THIS ACT; TO REQUIRE A CONTROLLER WHO SELLS A CONSUMER'S PERSONAL INFORMATION TO THIRD PARTIES OR ENGAGES IN TARGETED ADVERTISING TO PROVIDE CLEAR AND CONSPICUOUS DISCLOSURE OF SUCH ACTIVITY TO A CONSUMER; TO REQUIRE PROCESSORS OF PERSONAL INFORMATION TO ASSIST CONTROLLERS IN THE DUTIES IMPOSED UNDER THIS ACT; TO REQUIRE CONTROLLERS TO CONDUCT AND DOCUMENT A DATA PROTECTION ASSESSMENT OF CERTAIN PROCESSING ACTIVITIES INVOLVING PERSONAL INFORMATION; TO REQUIRE A CONTROLLER IN POSSESSION OF DE-IDENTIFIED DATA TO TAKE REASONABLE MEASURES TO ENSURE THE DATA CANNOT BE ASSOCIATED WITH A NATURAL PERSON; TO PROVIDE THAT NOTHING IN THIS ACT RESTRICTS A CONTROLLER OR PROCESSOR'S ABILITY TO COMPLY WITH OTHER LAWS, INVESTIGATIONS OR LAW ENFORCEMENT REQUESTS, TO DEFEND LEGAL CLAIMS, TO PROVIDE CERTAIN PRODUCTS OR SERVICES SPECIFICALLY REQUESTED BY THE CONSUMER, TO PERFORM UNDER A VALID CONTRACT, TO RESPOND TO SECURITY INCIDENTS, OR TO ENGAGE IN SCIENTIFIC OR STATISTICAL RESEARCH; TO PROVIDE THAT NOTHING IN THIS ACT RESTRICTS A CONTROLLER OR PROCESSOR'S ABILITY TO USE DATA TO CONDUCT RESEARCH, EFFECTUATE A PRODUCT RECALL, RESPOND TO TECHNICAL ERRORS, OR PERFORM CERTAIN INTERNAL OPERATIONS; TO PROVIDE THAT THE ATTORNEY GENERAL SHALL HAVE THE EXCLUSIVE AUTHORITY TO ENFORCE THIS ACT; TO AUTHORIZE THE ATTORNEY GENERAL TO INVESTIGATE POTENTIAL VIOLATIONS OF THIS ACT AND ISSUE CIVIL INVESTIGATIVE DEMANDS; TO PROVIDE CERTAIN RELIEF AND CIVIL PENALTIES FOR VIOLATIONS OF THIS ACT; TO AMEND SECTION 45-38-9, MISSISSIPPI CODE OF 1972, TO PROVIDE THAT THE REQUIREMENTS OF THE WALKER MONTGOMERY PROTECTING CHILDREN ONLINE ACT SHALL CONTROL IN THE CASE OF A CONFLICT WITH THIS ACT; TO BRING FORWARD SECTION 11-77-5, MISSISSIPPI CODE OF 1972, FOR THE PURPOSE OF POSSIBLE AMENDMENT; AND FOR RELATED PURPOSES.
Impact
The bill introduces a range of stipulations that businesses must comply with when interacting with consumer data, reinforcing the responsibility of controllers regarding data security and user privacy. Companies will be mandated to conduct data protection assessments for high-risk activities, implement adequate data security practices, and provide transparent privacy notices. This change signifies a more rigorous approach to consumer privacy in Mississippi, aligning state law with existing privacy standards observed in other states and enhancing consumer protection against data misuse.
Summary
House Bill 1051, known as the Mississippi Consumer Privacy Protection Act, aims to establish a regulatory framework focused on protecting consumer data and privacy within the state. The bill applies specifically to businesses generating over $25 million in revenue and handling significant amounts of personal information. Its primary objective is to ensure consumers have rights over their data, including the ability to access, correct, and delete personal information, as well as to opt out of processing by companies that control such data. The act is poised to enhance consumers' privacy rights by requiring clear disclosures from businesses regarding the collection and use of personal information.
Contention
Despite the proactive stance on consumer privacy, the bill has generated discussions about its practical implications and the extent of enforcement capabilities. The Mississippi Attorney General is granted exclusive authority for enforcement and investigation of violations, with potential civil penalties for non-compliance. However, concerns have been raised about the adequacy of the resources and support for the Attorney General’s office to effectively oversee the implementation of these provisions. Moreover, the balance between consumer protection and the operational flexibility of businesses operating within the state remains a contentious issue, as businesses express that excessive regulation could stifle innovation and growth.