Title 42, Title 42: Business, Selling, Trading and Collection Practices

Sec. 42-516. Applicability. The provisions of sections 42-515 to 42-525, inclusive, apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and that during the preceding calendar year: (1) Cont…

Sec. 42-517. Exemptions. (a) The provisions of sections 42-515 to 42-525, inclusive, do not apply to any: (1) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (2) person who has entered into a contract wit…

Sec. 42-518. Consumers' rights. Compliance by Controllers. Appeals. (a) A consumer shall have the right to: (1) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, unless such confirmation or access would require the contr…

Sec. 42-519. Authorized agents and consumer opt-out. A consumer may designate another person to serve as the consumer's authorized agent, and act on such consumer's behalf, to opt out of the processing of such consumer's personal data for one or more of the purposes specified in …

Sec. 42-520. Controllers' duties. Sale of personal data to third parties. Notice and disclosure to consumers. Consumer opt-out. (a) A controller shall: (1) Limit the collection of personal data to what is adequate, relevant and reasonably necessary in relation to the purposes for…

Sec. 42-521. Processors' duties. Contracts between controllers and processors. (a) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller's obligations under sections 42-515 to 42-525, inclusive. Such assistance shal…

Sec. 42-522. Controllers' data protection assessments. Disclosure to Attorney General. (a) A controller shall conduct and document a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer. For the purpos…

Sec. 42-523. De-identified and pseudonymous data. Controllers' duties. Exceptions. Applicability of consumers' rights. Disclosure and oversight. (a) Any controller in possession of de-identified data shall: (1) Take reasonable measures to ensure that the data cannot be associated…

Sec. 42-524. Construction of controllers', consumer health date controllers' and processors' duties. (a) Nothing in sections 42-515 to 42-526, inclusive, shall be construed to restrict a controller's, processor's or consumer health data controller's ability to: (1) Comply with fe…

Sec. 42-525. Enforcement by Attorney General. Notice of violation. Cure period. Report. Penalty. (a) The Attorney General shall have exclusive authority to enforce violations of sections 42-515 to 42-524, inclusive, and section 42-526. (b) (1) During the period beginning on July …

Sec. 42-526. Consumer health data privacy. Disclosure, access and geofencing. Exemptions. (a)(1) Except as provided in subsection (b) of this section, subsections (b) and (c) of section 42-517 and section 42-524, no person shall: (A) Provide any employee or contractor with access…

Sec. 42-527. Reserved for future use. PART II SOCIAL MEDIA PLATFORMS, ONLINE SERVICES,PRODUCTS OR FEATURES AND MINORS (A) SOCIAL MEDIA PLATFORMS AND MINORS

Sec. 42-528. Social media platforms and minors. Request to unpublish or delete minor's account. Enforcement. Penalty. (a) For the purposes of this section: (1) “Authenticate” means to use reasonable means and make a commercially reasonable effort to determine whether a request to…

Sec. 42-529. Definitions. For the purposes of this section and sections 42-529a to 42-529e, inclusive: (1) “Adult” means any individual who is at least eighteen years of age; (2) “Consent” has the same meaning as provided in section 42-515; (3) “Consumer” has the same meaning as …

Sec. 42-529a. Controllers' duties. Consumer consent. (a) Each controller that offers any online service, product or feature to consumers whom such controller has actual knowledge, or wilfully disregards, are minors shall use reasonable care to avoid any heightened risk of harm to…

Sec. 42-529b. Controllers' data protections assessments. Review, record keeping, confidentiality and disclosure. Risk mitigation plan. (a) Each controller that, on or after October 1, 2024, offers any online service, product or feature to consumers whom such controller has actual…

Sec. 42-529c. Processors' duties. Contracts between controllers and processors. (a) A processor shall adhere to the instructions of a controller, and shall: (1) Assist the controller in meeting the controller's obligations under sections 42-529 to 42-529e, inclusive, taking into …

Sec. 42-529d. Exemptions. (a) The provisions of sections 42-529 to 42-529c, inclusive, and section 42-529e shall not apply to any: (1) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (2) organization that…

Sec. 42-529e. Enforcement by Attorney General. Notice of violation. Cure period. Report. Penalty. (a) Any violation of the provisions of sections 42-529 to 42-529d, inclusive, shall constitute an unfair trade practice under subsection (a) of section 42-110b and shall be enforced …

Secs. 42-530 to 42-899. Reserved for future use. Note: Chapters 743kk to 746 are also reserved for future use.