ENTITLED An Act to require that social media companies provide collected personal data of a user at the user's request and maintain transparent interoperability interfaces.

Be it enacted by the Legislature of the State of South Dakota:

Section 1. That § 53-12-1 be AMENDED:

53-12-1. Terms used in this chapter mean:

(1) "Agreement," the bargain of the parties in fact, as found in their language or inferred from other circumstances and from rules and procedures given the effect of agreements under laws otherwise applicable to a particular transaction;

(2) "Automated transaction," a transaction conducted or performed, in whole or in part, by electronic means or electronic records, in which the acts or records of one or both parties are not reviewed by an individual in the ordinary course in forming a contract, performing under an existing contract, or fulfilling an obligation required by the transaction;

(3) "Blockchain technology," technology that uses a distributed, shared, and replicated ledger, either public or private, with or without permission, or driven with or without tokenized crypto economics where the data on the ledger is protected with cryptography and is immutable and auditable;

(4) "Computer program," a set of statements or instructions to be used directly or indirectly in an information processing system in order to bring about a certain result;

(5) "Contract," the total legal obligation resulting from the parties' agreement as affected by this chapter and other applicable law;

(6) "Electronic," any technology, including blockchain technology, using electrical, digital, magnetic, wireless, optical, electromagnetic, or similar capabilities;

(7) "Electronic agent," a computer program or an electronic or other automated means used independently to initiate an action or respond to electronic records or performances in whole or in part, without review or action by an individual;

(8) "Electronic record," a record created, generated, sent, communicated, received, or stored by electronic means. The term includes a record that is secured through blockchain technology;

(9) "Electronic signature," an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record. The term includes a signature that is secured through blockchain technology;

(10) "Governmental agency," an executive, legislative, or judicial agency, department, board, commission, authority, institution, or instrumentality of the federal government or of a state or of a county, municipality, or other political subdivision of a state;

(11) "Information," data, text, images, sounds, codes, computer programs, software, databases, or the like;

(12) "Information processing system," an electronic system for creating, generating, sending, receiving, storing, displaying, or processing information;

(13) "Open protocol," a publicly available technical standard that:

(a) Enables interoperability and data exchange between social media services by providing a common data standard to facilitate the exchange of a user's personal data across multiple social media services; and

(b) Is free from licensing fees and patent restrictions;

(14) "Person," an individual, corporation, business trust, estate, trust, partnership, limited liability company, association, joint venture, governmental agency, public corporation, or any other legal or commercial entity;

(15) "Personal data," information that is linked or reasonably linkable to an identified or identifiable individual, including data that represents the individual's connections and interactions within a social media service, and excluding de-identified data, aggregated data, or publicly available information;

(16) "Record," information that is inscribed on a tangible medium or that is stored in an electronic or other medium and is retrievable in perceivable form;

(17) "Security procedure," a procedure employed for the purpose of verifying that an electronic signature, record, or performance is that of a specific person or for detecting changes or errors in the information in an electronic record. The term includes a procedure that requires the use of algorithms or other codes, identifying words or numbers, encryption, or callback or other acknowledgment procedures;

(18) "Social media company," an entity that owns or operates a social media service;

(19) "Social media service," a public website or application that:

(a) Displays content that is primarily generated by account holders and not by the social media company;

(b) Permits an individual to register as an account holder and create a profile that is made visible to the public or a set of other users defined by the account holder;

(c) Allows account holders to view content generated by other users;

(d) Allows account holders to post content viewable by other users;

(e) Is not identifiable as email, cloud storage, interactive gaming, or document viewing, sharing, or collaboration services; and

(f) Is not a service or application that consists primarily of electronic commerce and for which any chat, comments, or interactive functionality is incidental to, directly related to, or dependent on the provision of the content;

(20) "State," a state of the United States, the District of Columbia, Puerto Rico, the United States Virgin Islands, or any territory or insular possession subject to the jurisdiction of the United States. The term includes an Indian tribe or band, or Alaskan native village, which is recognized by federal law or formally acknowledged by a state;

(21) "Transaction," an action or set of actions occurring between two or more persons relating to the conduct of business, commercial, or governmental affairs; and

(22) "User," an individual who is a resident of this state, acting only in an individual or household context and who accesses or uses a social media service.

Section 2. That § 55-1A-35.1 be AMENDED:

55-1A-35.1. If otherwise validly executed, the following documents may be executed in accordance with chapter 53-12:

(1) The governing instrument of an express trust, or other document, other than a will or codicil as defined in title 29A;

(2) The resignation, removal, appointment, or acceptance of appointment of any trustee, any advisor or protector, or of any designated representation addressed in title 55;

(3) A consent, release, ratification, or indemnification addressed in title 55; and

(4) Any other document addressed by title 55 to the extent it is not excluded from the scope of chapter 53-12.

Notwithstanding any provision of chapter 53-12 to the contrary, the documents under this section are deemed to be a transaction, as defined in § 53-12-1, and are within the scope of chapter 53-12.

Section 3. That a NEW SECTION be added to chapter 53-12:

If a user requests a copy of the user's personal data being held by a social media service with more than one hundred million active monthly users and whose primary focus is not charity or religion, the social media service must provide the personal data in a format that:

(1) Is portable to the extent technically feasible;

(2) Is readily usable to the extent practicable; and

(3) Allows the user to transmit the data to another social media service, without impediment.

Section 4. That a NEW SECTION be added to chapter 53-12:

A social media company operating a social media service with more than one hundred million active monthly users and whose primary focus is not charity or religion shall implement a transparent, third-party-accessible interoperability interface subject to section 3 of this Act to allow the social media service's users to choose to:

(1) Expose a common set of the user's personal data to other social media services; and

(2) Enable third parties to access content created by the user and to be notified when new or updated content is available, with the user's permission.

Section 5. That a NEW SECTION be added to chapter 53-12:

To achieve interoperability under section 4 of this Act, a social media company operating a social media service with more than one hundred million active monthly users and whose primary focus is not charity or religion shall provide users with the ability to export their social graph to social media services in the following manner:

(1) The social media service shall allow a user the ability to choose whether to export all of a user's social graph data or export only a subset of that data, and a user may select a subset of the data by selecting:

(a) Certain types of data;

(b) Certain dates of data; or

(c) Data generated since a previous transfer;

(2) A social media service shall make the export available in a machine readable format;

(3) A social media service shall make the export using a publicly available technical standard that is free from:

(a) Licensing fees; and

(b) Patent restrictions that any social media service can freely use;

(4) The social media service shall allow a user to choose between a single export or continuous, ongoing exports, which must occur at least every twenty-four hours;

(5) The social media service shall ensure that the exports are done in a manner consistent with industry best practices for privacy and security; and

(6) The social media service providing the export may impose reasonable terms on the transfer, including terms to ensure privacy and security, provided that the terms do not discriminate between social media services and do not unfairly preference the social media service's own service over others.

Nothing in this section restricts a social media platform's ability to detect, prevent, protect against, or respond to a security incident, risk to safety or integrity, harassment, malicious or fraudulent activity, or any illegal activity. Nothing in this section restricts a social media platform's ability to comply with any legal obligations.

Section 6. That a NEW SECTION be added to chapter 53-12:

A social media company operating a social media service with more than one hundred million active monthly users and whose primary focus is not charity or religion shall secure all personal data obtained through an interoperability interface and safeguard the privacy and security of a user's personal data obtained from other social media services through the interoperability interface, in accordance with the social media company's privacy notice and administrative, technical, and physical data security practices.

Section 7. That a NEW SECTION be added to chapter 53-12:

Sections 3 to 6, inclusive, of this Act do not apply to an entity that is owned, controlled, operated, or maintained by a religious organization and is exempt from property taxation under state law.

Section 8. That a NEW SECTION be added to chapter 53-12:

Nothing in this Act requires a social media service to import any data or treat imported data differently from any other use-generated content on the service.

Section 9. This Act is effective beginning July 1, 2027.

An Act to require that social media companies provide collected personal data of a user at the user's request and maintain transparent interoperability interfaces.