SB 1121 Summary

• Establishes consumer rights to access, delete, and opt-out of the sale of personal information held by businesses, effective January 1, 2020.

• Requires businesses to disclose personal information collection practices in accessible formats and provide designated methods for consumers to submit requests within 45 days.

• Creates a private right of action for consumers whose nonencrypted personal information is unlawfully accessed, with statutory damages of $100-$750 per consumer per incident or actual damages, whichever is greater.

• Exempts from the act: medical information, health insurance information, financial information under federal law, driver's license information, and information collected in clinical trials.

• Establishes civil penalties of up to $2,500 per violation or $7,500 per intentional violation, enforced by the Attorney General, with penalties deposited in a Consumer Privacy Fund.