OH HB807

Prohibits state agencies, state officials, data brokers, and private entities from selling sensitive personal data to data brokers or private entities for profit, unless the data is used for a permitted purpose

Defines "sensitive data" as information including name, date of birth, social security number, telephone number, character, general reputation, personal characteristics, immigration status, facial recognition data, or mode of living

Allows exceptions for permitted uses including credit/insurance evaluation, employment purposes, child support enforcement, FDIC/NCUA functions, court orders, consumer consent, and criminal investigations

Creates civil penalties of $500 in statutory damages for violations, and $2,500 for obtaining sensitive data under false pretenses or knowingly without a permitted use, plus actual damages and attorney's fees

Establishes repeat violations involving false pretenses as a fourth-degree felony, to be prosecuted by the attorney general