An Act to regulate how broadband internet access service providers use customer data.

Be it enacted by the Legislature of the State of South Dakota:

Section 1. That a NEW SECTION be added to chapter 49-31:

Terms used in this Act mean:

(1) "Aggregate customer personal information dataset," a collection of data that relates to a group or category of customers, which is not linked or reasonably linkable to any individual person, household, or device, and from which individual customer identities and characteristics have been removed;

(2) "Broadband internet access service," a mass-market retail service, by wire or radio, that provides the capability to transmit data to and receive data from all or substantially all internet endpoints, including any capabilities that are incidental to and enable the operation of the communications service, but excluding dial-up internet access service;

(3) "Broadband internet access service provider," a person engaged in furnishing broadband internet access service;

(4) "Customer," a current or former subscriber to, or applicant for, broadband internet access service;

(5) "Customer personal information," the following data, which is collected by a broadband internet access service provider from or about a customer and is made available to the broadband internet access service provider by a customer solely by virtue of the service provider-customer relationship:

(a) Content of communications, and any part of the substance, purpose, or meaning of a communication or any other part of a communication that is highly suggestive of the substance, purpose, or meaning of a communication, and which includes application payload;

(b) Date of birth, age, ethnicity, gender, nationality, political beliefs, race, religion, or sexual orientation;

(c) Device identifiers;

(d) Financial information;

(e) Government-issued personal identification numbers;

(f) Health information;

(g) Information concerning a customer that is collected or made available and is maintained in a way that is linked or reasonably linkable to a customer or device;

(h) Information pertaining to children; and

(i) Name and billing information; and

(6) "Opt-in consent," affirmative, express customer approval for the requested use, disclosure, sale, or access to the customer personal information after the customer is provided appropriate notification of the broadband service provider's practices under section 3 of this Act.

Section 2. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider may not use, disclose, sell, or permit access to customer personal information, except as set forth in this Act.

Section 3. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider may use, disclose, sell, or permit access to customer personal information, if the service provider obtains prior opt-in consent from the customer, which the customer may revoke at any time.

A service provider shall employ a mechanism for customers to grant, deny, or withdraw consent that is:

(1) Clear;

(2) Comprehensible;

(3) Conspicuous;

(4) Easy to use;

(5) Made available to the customer at no additional cost; and

(6) Not misleading.

A customer's grant, denial, or withdrawal of consent must be given effect promptly and remain in effect until the customer revokes or limits the grant, denial, or withdrawal of consent.

A service provider may not refuse to serve a customer who does not consent under this section, and may not charge a customer a higher price or offer a customer a discount or other benefit based on the customer's decision to provide or not provide consent.

Section 4. That a NEW SECTION be added to chapter 49-31:

A service provider may use, disclose, sell, or permit access to customer personal information without customer approval:

(1) For the purpose of providing broadband internet access service from which the information is derived or for purposes necessary for the provision of the service;

(2) To comply with legal process or other laws, court orders, or administrative orders;

(3) To initiate, render, bill for, and collect payment for broadband internet access service;

(4) To protect the right or property of the broadband internet access service provider or to protect customers and other service providers from fraudulent, abusive, or unlawful use of or subscription to the service provider's broadband internet service network;

(5) To provide, for purposes of responding to the customer's request for emergency services, location information to:

(a) A hospital emergency or trauma care facility;

(b) An emergency medical service provider or emergency dispatch provider;

(c) A public safety, fire service, or law enforcement official; or

(d) A public safety answering point;

(6) To provide, for purposes of responding to the customer's request for emergency services, location information to:

(a) The customer's legal guardian;

(b) A member of the customer's family; or

(c) An individual reasonably believed by the broadband internet service access provider to be a close personal friend of the customer; or

(7) To providers of information or database management services, solely for purposes of assisting in the delivery of emergency services.

Section 5. That a NEW SECTION be added to chapter 49-31:

A service provider may not retain customer personal information for longer than reasonably necessary to accomplish the purposes for which the information was collected, unless the data is part of an aggregate customer personal information dataset.

Section 6. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider may use, disclose, sell, or permit access to customer personal information to advertise or market the service provider's communications-related services to the customer, provided that:

(1) The broadband internet access service provider notifies the customer of the right to opt out in accordance with the requirements set forth in section 3 of this Act; and

(2) The customer may opt out of that use, disclosure, sale, or access at any time.

Section 7. That a NEW SECTION be added to chapter 49-31:

Nothing in this Act restricts broadband internet access service providers from:

(1) Generating an aggregate customer personal information dataset using customer personal information; or

(2) Using, disclosing, selling, or permitting access to an aggregate customer personal information dataset generated by the service provider.

Section 8. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider shall implement and maintain reasonable measures to protect customer personal information from unauthorized use, disclosure, sale, access, destruction, or modification.

A broadband internet access service provider may employ any lawful security measures to comply with the requirements set forth in this Act.

Providers that utilize reasonable measures to protect customer personal information may not be liable for unauthorized access to customer personal information.

Section 9. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider shall notify each customer of the requirements of sections 1 to 8, inclusive, of this Act.

The service provider shall make the notice subsequently and persistently available.

The notice required by this section must also specify and describe:

(1) The types of customer personal information collected, how that information is used by the service provider, and how long the service provider retains the data;

(2) The circumstances under which the service provider discloses, sells, or permits access to the information that it collects; and

(3) The customer's right to consent to the use of, disclosure of, sale of, or access to the customer's personal information, and how that right may be exercised.

Section 10. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider shall notify customers in advance of any material change to the notice required under section 9 of this Act or to the manner in which the service provider uses, discloses, sells, or permits access to customer personal information.

A service provider shall yearly notify the customer that the customer may grant, deny, or withdraw consent, at any time and in any manner in accordance with section 3 of this Act.

For purposes of this section, "material change" means a significant modification to the terms, conditions, or capabilities of a service so as to fundamentally alter the original scope of the service.

Section 11. That a NEW SECTION be added to chapter 49-31:

A broadband internet access service provider shall, upon a customer's affirmative written request, disclose the customer personal information to any person designated by the customer.