Compare versions
--- version:HB 367+++ version:(document, no version)@@ -1,1176 +1,507 @@-HB0367a -1- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--34-LS1485\N-- HOUSE BILL NO. 367--IN THE LEGISLATURE OF THE STATE OF ALASKA--THIRTY-FOURTH LEGISLATURE - SECOND SESSION--BY REPRESENTATIVE STORY--Introduced: 2/23/26-Referred: Judiciary, Finance--A BILL--FOR AN ACT ENTITLED--"An Act relating to the privacy of consumer personal information; establishing the 1-Consumer Personal Information Privacy Act; establishing data broker registration 2-requirements; relating to social security numbers; making certain violations unfair or 3-deceptive trade practices; and providing for an effective date." 4-BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA: 5- * Section 1. AS 44.33.020(a) is amended by adding a new paragraph to read: 6-(45) establish and maintain a data broker registry established under 7-AS 45.48.900. 8- * Sec. 2. AS 45.48.430(b) is amended to read: 9-(b) The prohibition in (a) of this section does not apply if 10-(1) the disclosure is authorized by local, state, or federal law, including 11-AS 45.48.800 - 45.48.945 or a regulation adopted under AS 45.48.470; 12-(2) the person is engaging in the business of government and 13-(A) is authorized by law to disclose the individual's social 14- 34-LS1485\N-HB 367 -2- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--security number; or 1-(B) the disclosure of the individual's social security number is 2-required for the performance of the person's duties or responsibilities as 3-provided by law; 4-(3) the disclosure is to a person subject to or for a transaction regulated 5-by the Gramm-Leach-Bliley Financial Modernization Act, and the disclosure is for a 6-purpose authorized by the Gramm-Leach-Bliley Financial Modernization Act or to 7-facilitate a transaction of the individual; 8-(4) the disclosure is to a person subject to or for a transaction regulated 9-by the Fair Credit Reporting Act, and the disclosure is for a purpose authorized by the 10-Fair Credit Reporting Act; 11-(5) the disclosure is part of a report prepared by a consumer credit 12-reporting agency in response to a request by a person and the person submits the social 13-security number as part of the request to the consumer credit reporting agency for the 14-preparation of the report; or 15-(6) the disclosure is for a background check on the individual, identity 16-verification, fraud prevention, medical treatment, law enforcement or other 17-government purposes, or the individual's employment, including employment benefits. 18- * Sec. 3. AS 45.48.450(b) is amended to read: 19-(b) Notwithstanding the other provisions of AS 45.48.400 - 45.48.480, and 20-except as provided under AS 45.48.800 - 45.48.945 or for an agent under (a) of this 21-section, a person may disclose an individual's social security number to an 22-independent contractor of the person to facilitate the purpose or transaction for which 23-the individual initially provided the social security number to the person, but the 24-independent contractor may not use the social security number for another purpose or 25-make an unauthorized disclosure of the individual's personal information. In this 26-subsection, "independent contractor" includes a debt collector. 27- * Sec. 4. AS 45.48 is amended by adding new sections to read: 28-Article 6A. Consumer Personal Information Privacy. 29-Sec. 45.48.800. Notice before collection; disclosure of information; other 30-notices. (a) A business that collects personal information from a consumer shall notify 31- 34-LS1485\N-HB0367a -3- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--the consumer before collecting the information. Notification to the consumer must 1-clearly and conspicuously indicate the categories of personal information that will be 2-collected, the specific purposes for which each category of personal information will 3-be used, the consumer's right under AS 45.48.835 not to have the consumer's personal 4-information sold, shared, or disclosed, and the limitations established under 5-AS 45.48.840 on the use of the consumer's precise geolocation data by the business. A 6-business may not collect an additional category of personal information or use the 7-collected personal information for an additional purpose without first notifying the 8-consumer in accordance with this section. 9-(b) A business shall maintain, and update at least once every 12 months, in the 10-business's online privacy policies and in any state-specific description of consumers' 11-privacy rights, or on the business's Internet website if the business does not maintain 12-online privacy policies or description, the following information: 13-(1) a description of a consumer's rights under AS 45.48.800 - 14-45.48.945; 15-(2) all the designated methods of the business by which a consumer 16-can request access to or deletion of information as provided under AS 45.48.800 - 17-45.48.945; 18-(3) a list of the categories of consumer personal information that the 19-business collected, sold, or disclosed for a business or commercial purpose in the 20-preceding 12 months, and a designation of that information as collected, sold, or 21-disclosed for a business or commercial purpose; or, if the business did not collect, sell, 22-or disclose any consumer personal information for a business or commercial purpose, 23-a disclosure of that fact; 24-(4) the categories of sources from which the consumer personal 25-information was collected; in this paragraph, "categories of sources" includes the 26-consumer, advertising networks, Internet service providers, data analytics providers, 27-government entities, operating systems and platforms, social networks, data brokers, 28-other sources listed in regulations adopted under AS 45.48.800 - 45.48.945, and other 29-types or groupings of persons or entities from which a business collects personal 30-information about consumers, described with enough particularity to provide 31- 34-LS1485\N-HB 367 -4- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--consumers with a meaningful understanding of the type of person or entity; 1-(5) a description of the business purpose or commercial purpose for 2-which each category of consumer personal information was collected, sold, or 3-disclosed; 4-(6) the categories of third parties to whom the business sold or 5-disclosed consumer personal information; in this paragraph, "categories of third 6-parties" includes advertising networks, Internet service providers, data analytics 7-providers, government entities, operating systems and platforms, social networks, data 8-brokers, other sources listed in regulations adopted under AS 45.48.800 - 45.48.945, 9-and other types or groupings of third parties with whom the business shares personal 10-information, described with enough particularity to provide consumers with a 11-meaningful understanding of the type of third party; 12-(7) a description of a consumer's right to request the specific pieces of 13-the consumer's personal information that the business collected; 14-(8) a statement that information collected to verify a consumer's 15-disclosure or deletion request shall only be used as provided in AS 45.48.850(d) and 16-(e)(1). 17-(c) In addition to the requirements under (b) of this section, a business shall 18-include on the home page of the business's Internet website under the business's online 19-privacy policies, if the business has online privacy policies, and under any state-20-specific description of consumers' privacy rights, the following: 21-(1) a clear and conspicuous link to an Internet website page titled "Do 22-Not Collect or Sell My Personal Information" that enables a consumer to exercise the 23-consumer's rights under AS 45.48.800 - 45.48.945; a business may not require a 24-consumer to create an account to access this Internet website page or to exercise the 25-consumer's rights under AS 45.48.800 - 45.48.945; and 26-(2) a description of a consumer's rights under AS 45.48.800 - 27-45.48.945. 28-(d) A business may comply with (c) of this section by including the required 29-content on a separate and additional Internet website page that is dedicated to 30-consumers. 31- 34-LS1485\N-HB0367a -5- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(e) A business shall include on an Internet website page dedicated to 1-consumers the content required under (b) and (c) of this section and reasonably ensure 2-that consumers are directed to the alternative Internet website. 3-(f) In this section, "home page" means 4-(1) the introductory page of an Internet website where personal 5-information is collected; 6-(2) in the case of a mobile application, the application's platform page 7-or download page, an electronic link within the application, and any other location that 8-allows consumers to review the notice required by (a) of this section. 9-Sec. 45.48.805. Limits on use, processing, collection, sharing, and retention 10-of personal information. (a) A business that collects a consumer's personal 11-information shall limit its collection and sharing of the personal information with third 12-parties to what is reasonably necessary for the business to provide a service or conduct 13-an activity that a consumer has requested, or has consented to, or that is reasonably 14-necessary for security or fraud prevention. In this subsection, "reasonably necessary 15-for security or fraud prevention" does not include profiting financially from the 16-personal information. 17-(b) A business that collects a consumer's personal information is not required 18-to retain personal information collected for a single one-time transaction if the 19-business does not sell or disclose the information. 20-(c) Except for the collection and sharing of personal information under (a) of 21-this section, a business shall limit the business's use and retention of collected personal 22-information to what is reasonably necessary to provide a service or conduct an activity 23-that a consumer has requested or consented to, or for a related operational purpose; 24-however, personal information that is collected or retained solely for security or fraud 25-prevention may not be used for operational purposes. 26-Sec. 45.48.810. Notification of business upon receipt or disclosure of 27-personal information. (a) When a person receives personal information for a business 28-purpose or commercial purpose that a business originally collected from a consumer, 29-the person shall notify the business that the person possesses the personal information 30-and provide the person's contact information. The person shall provide updated contact 31- 34-LS1485\N-HB 367 -6- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--information to the business if the person's contact information changes. 1-(b) A person who receives personal information that a business originally 2-collected from a consumer, and who discloses the personal information to another 3-person for a business purpose or commercial purpose, shall notify the business that 4-originally collected the information not later than 10 days after the disclosure. The 5-notification must include the contact information of the person to whom the personal 6-information was disclosed. 7-(c) A person that receives personal information that a business originally 8-collected from a consumer shall either de-identify the personal information or 9-maintain the personal information in a way that the person can readily comply with a 10-disclosure or deletion request under AS 45.48.800 - 45.48.945. 11-Sec. 45.48.815. Required records. A business that collects or has collected 12-personal information from a consumer shall maintain records of each person to whom 13-the business discloses the personal information. The business shall also maintain all 14-records provided to the business under AS 45.48.810(a) and (b). 15-Sec. 45.48.820. Request for disclosure of collected personal information. 16-(a) A consumer may request a business that collects or collected the consumer's 17-personal information to disclose to the consumer 18-(1) the categories and specific pieces of personal information that the 19-business collects or collected within the five years preceding the date of the request; 20-(2) the sources from which the business collects or collected each 21-category of personal information; and 22-(3) the business purpose or commercial purpose for the collection of 23-each category of personal information. 24-(b) A business shall respond to a consumer request under this section as 25-required by AS 45.48.850. 26-Sec. 45.48.825. Request for deletion of personal information. (a) A 27-consumer may request a business to delete any of the consumer's personal information 28-collected by the business from the consumer within the five years preceding the date 29-of the request. 30-(b) Upon receiving a consumer request under this section, a business shall 31- 34-LS1485\N-HB0367a -7- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--delete from the business's records the information identified in the request. 1-(c) Within 45 days after a consumer's deletion request, a business that receives 2-a deletion request under (b) of this section shall direct all persons to whom a business 3-disclosed records under AS 45.48.810 to delete the personal information and provide a 4-written statement verifying that the information has been deleted. A person shall 5-comply with a direction under this subsection. The business shall immediately provide 6-written notification to the attorney general and the consumer of a person who fails to 7-provide written verification of compliance. 8-(d) A person is not required to delete personal information under (c) of this 9-section if the person maintains the personal information to 10-(1) complete the transaction for which the personal information was 11-collected; 12-(2) provide a good or service requested or reasonably anticipated 13-within an ongoing business relationship with the consumer; 14-(3) fulfill the terms of a written warranty or product recall conducted in 15-accordance with federal law; 16-(4) perform a contract between the business and consumer; 17-(5) detect security incidents, protect against malicious, deceptive, 18-fraudulent, or illegal activity, or prosecute the person responsible for that activity; 19-(6) identify and repair errors that impair the existing intended 20-functionality of a product or service; 21-(7) exercise a right provided for by law, including the right under the 22-First Amendment of the United States Constitution and art. I, sec. 5, of the 23-Constitution of the State of Alaska to freedom of speech, or ensure the right of another 24-consumer to exercise that consumer's right to freedom of speech; 25-(8) comply with a search warrant, subpoena, or court order; 26-(9) engage in public or peer-reviewed scientific, historical, or 27-statistical research in the public interest that adheres to all other applicable ethics and 28-privacy laws, if 29-(A) the deletion of information is likely to seriously impair or 30-render impossible the achievement of the research; and 31- 34-LS1485\N-HB 367 -8- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--(B) the consumer has provided consent to the research; 1-(10) enable solely internal uses that are reasonably aligned with the 2-consumer's expectations, based on the consumer's relationship with the business; or 3-(11) comply with a legal obligation. 4-(e) A person may not disclose personal information that a business collected 5-from a consumer unless the personal information is disclosed in accordance with a 6-contract that requires the recipient to comply with a deletion request issued under 7-AS 45.48.800 - 45.48.945. 8-Sec. 45.48.830. Request for disclosure of personal information sold or 9-disclosed for a business purpose or commercial purpose. (a) A consumer may 10-request that a business that sold or disclosed the consumer's personal information for a 11-business purpose or commercial purpose within the last five years disclose to the 12-consumer 13-(1) the third parties subject to AS 45.48.810 in possession of the 14-consumer's personal information; 15-(2) the categories of personal information or specific pieces of personal 16-information that were sold or disclosed to each third party for a business purpose or 17-commercial purpose; 18-(3) for the third parties to which the business directly disclosed the 19-consumer's personal information for a business purpose or commercial purpose, the 20-business purpose or commercial purpose for disclosing each category of personal 21-information. 22-(b) A business shall respond to a consumer request under this section as 23-required by AS 45.48.850. 24-Sec. 45.48.835. Request not to sell, share, or disclose personal information. 25-(a) A consumer may, at any time, request a business not to sell, share, or disclose the 26-consumer's personal information or not to sell, share, or disclose particular categories 27-of the consumer's personal information. 28-(b) If a business collects personal information from a consumer online and the 29-consumer uses a global privacy control, the business shall treat the use of the global 30-privacy control as a valid request submitted by the consumer under (a) of this section 31- 34-LS1485\N-HB0367a -9- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--not to sell, share, or disclose the consumer's personal information. In this subsection, 1-(1) "extension" means a piece of software code that enables a 2-computer application or program to perform an activity the application or program 3-cannot do by itself; 4-(2) "global privacy control" includes a browser extension, privacy 5-setting, device setting, or other mechanism that communicates or signals the 6-consumer's choice not to have the consumer's personal information sold, shared, or 7-disclosed. 8-(c) A consumer may, as provided by regulation adopted under AS 45.48.915, 9-authorize another person solely to request that a business not sell, share, or disclose 10-the consumer's personal information, and a business shall comply with the request 11-received from the person for the consumer. 12-(d) A business shall respond to a consumer request under this section as 13-required by AS 45.48.850, unless the consumer later provides a clear and explicit 14-renunciation of the request. For one year after receiving a request under (a) - (c) of this 15-section, a business may not contact the consumer to request that the consumer 16-renounce the request. 17-(e) A business subject to this section may only use the personal information 18-collected from a consumer request under this section to comply with the request, 19-unless otherwise authorized by the consumer or by another provision of law. 20-Sec. 45.48.840. Use and disclosure of precise geolocation data. (a) A 21-business may use a consumer's precise geolocation data for other purposes than the 22-purpose disclosed under AS 45.48.800(a) if the consumer consents to the use. A 23-consumer who consents to the use of the consumer's precise geolocation data for other 24-purposes may, at any time, request that the business stop using the data for other 25-purposes. The consumer's consent must be in writing and in an agreement separate 26-from any other agreement for use, and the consumer must agree to the business's use 27-of the consumer's precise geolocation data for other purposes. 28-(b) Except as provided in (a) of this section, a business shall limit the use and 29-disclosure of a consumer's precise geolocation data to that necessary to provide goods 30-or services that a consumer requests and reasonably expects, or goods and services the 31- 34-LS1485\N-HB 367 -10- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--business reasonably expects the consumer will request. 1-(c) The provisions of AS 45.48.800 - 45.48.945 do not apply to a business that 2-uses a consumer's precise geolocation data if the consumer is an employee, contractor, 3-or vendor of the business. 4-Sec. 45.48.845. Treatment of individuals 16 years of age or under. (a) 5-Notwithstanding any other provision of AS 45.48.800 - 45.48.945, a business that has 6-actual knowledge that a consumer is 16 years of age or under may not 7-(1) disclose the personal information of the consumer for a business 8-purpose or commercial purpose, or use the consumer's precise geolocation data for a 9-purpose other than to provide goods or services that the consumer reasonably requests 10-and expects, unless the consumer's parent or guardian consents to the disclosure or 11-use; or 12-(2) sell or share the personal information of the consumer. 13-(b) A business that recklessly disregards a reasonable likelihood that a 14-consumer is 16 years of age or under is considered to have actual knowledge of the 15-consumer's age. In this subsection, "recklessly" has the meaning given in 16-AS 11.81.900(a). 17-(c) A business may not track or profile the personal information of an 18-individual who is 16 years of age or under in order to provide to the individual a 19-commercial advertisement that is based on the personal information or online activity 20-of the individual. 21-Sec. 45.48.850. Disclosure or deletion request; process. (a) A business shall 22-respond to a consumer request under AS 45.48.820 or 45.48.830 by 23-(1) providing the requested information electronically to the consumer 24-in a portable and, to the extent technically feasible, readily useable format that allows 25-the consumer to transmit the information to another person without hindrance; 26-(2) if the information provided under (1) of this subsection is not in a 27-human-readable format, providing the requested information to the consumer in a 28-format that is easily readable by a human; and 29-(3) at the consumer's request, providing the requested information by 30-mail. 31- 34-LS1485\N-HB0367a -11- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(b) A business subject to AS 45.48.800 - 45.48.945 shall designate at least two 1-methods for a consumer to submit a request under AS 45.48.820 - 45.48.835, 2-including, at a minimum, a toll-free telephone number and an electronic mail address. 3-If a business maintains an Internet website, the website must include an option to 4-submit requests under AS 45.48.820 - 45.48.835 on a public facing page. A designated 5-method for submitting requests may include a mailing address, electronic mail 6-address, Internet website, Internet website portal, toll-free telephone number, other 7-applicable contact information, or a new consumer-friendly means of contacting a 8-business as determined by regulation. 9-(c) A person may not charge a consumer a fee for performing a duty required 10-by AS 45.48.800 - 45.48.945. 11-(d) A person may only use the information provided by a consumer in a 12-request made under AS 45.48.820 - 45.48.835 to identify the consumer and comply 13-with the request. 14-(e) In response to a request made under AS 45.48.820 - 45.48.835, a business 15-shall 16-(1) promptly determine whether the request is a consumer request; a 17-business may not require that a consumer create an account with the business; 18-however, if the consumer maintains an account with the business, the business may 19-require the consumer to submit the request through the account; 20-(2) identify in writing the personal information subject to a disclosure 21-request; the information disclosed must 22-(A) cover the 12-month period preceding the request, or 23-another applicable period designated by the consumer; 24-(B) be designated by the most relevant category of personal 25-information; 26-(C) clearly separate information requested under AS 45.48.820 27-and 45.48.830; 28-(3) disclose and deliver the identified information in writing not later 29-than 45 days after receipt of the request; 30-(4) not later than 45 days after receipt of a deletion request, comply 31- 34-LS1485\N-HB 367 -12- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--with AS 45.48.825, and provide confirmation of compliance to the consumer. 1-(f) The time to respond to a disclosure or deletion request under (e)(3) and (4) 2-of this section may be extended once for an additional 45 days when reasonably 3-necessary. If the time to respond is extended, the business shall notify the consumer of 4-the extension. 5-(g) A business may disclose or provide confirmation of deletion of 6-information to the consumer by mail, through the consumer's account with the 7-business, or electronically at the consumer's request if the consumer does not have an 8-account with the business. 9-(h) Notwithstanding any other requirement in this section, if a consumer's 10-requests are manifestly unfounded or excessive, in particular because of the requests' 11-repetitive character, a business may either charge a reasonable fee, taking into account 12-the administrative costs of complying with the consumer's request, or refuse to act on 13-the request. The business shall notify the consumer of a decision to charge a fee or to 14-deny a request within the timeline provided under (e)(3) and (4) and (f) of this section. 15-The notification must completely explain the business's reason for finding the request 16-manifestly unfounded or excessive, including all pertinent facts. The business shall 17-bear the burden of proving that a consumer's request is manifestly unfounded or 18-excessive. 19-(i) A business is not required to respond to a disclosure or deletion request 20-under AS 45.48.825 or 45.48.830 if the consumer making the request has made two 21-consumer requests in the previous 365 days. 22-(j) A business is not required under this section to re-identify or otherwise link 23-data that, in the ordinary course of business, is not maintained in a manner that would 24-be considered personal information. 25-Sec. 45.48.855. Third-party disclosure and handling of personal 26-information. (a) A third party may not disclose personal information to another 27-person if the personal information was originally collected in violation of 28-AS 45.48.800 or 45.48.835. A third party that reasonably inquires into whether 29-personal information was collected in violation of AS 45.48.800 or 45.48.835, and 30-reasonably concludes that information was not obtained in violation of AS 45.48.800 31- 34-LS1485\N-HB0367a -13- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--or 45.48.835 may not be held liable for a violation under this section. 1-(b) A third party may not disclose a consumer's personal information for a 2-business purpose or commercial purpose unless the third party receives written 3-confirmation from the business that originally collected the personal information that 4-the information was collected in compliance with AS 45.48.800 and 45.48.835. 5-Sec. 45.48.860. Service provider obligations. (a) A service provider may not 6-(1) retain, use, or disclose personal information received from a 7-business for any purpose other than to perform the services specified in a written 8-contract with the business; 9-(2) combine personal information received from a business with 10-personal information the service provider receives from other sources, unless 11-otherwise provided in regulation; 12-(3) disclose personal information received from a business to any other 13-person without first 14-(A) receiving written consent of the business to disclose the 15-personal information to the other person; and 16-(B) entering into a written contract with the other person that 17-prohibits the other person from engaging in conduct prohibited under this 18-section. 19-(b) A person who receives personal information from a service provider may 20-not disclose the personal information to any other person. 21-Sec. 45.48.865. Exemptions. (a) AS 45.48.800 - 45.48.945 do not apply to 22-(1) protected health information that is collected by a covered entity or 23-business associate governed by the privacy, security, and breach notification rules 24-issued by the United States Department of Health and Human Services in 45 C.F.R. 25-Parts 160 and 164, established under the Health Insurance Portability and 26-Accountability Act of 1996 (P.L. 104-191) and the Health Information Technology for 27-Economic and Clinical Health Act (P.L. 111-5); in this paragraph, "protected health 28-information" has the meaning given in 45 C.F.R. 160.103; 29-(2) a covered entity governed by the privacy, security, and breach 30-notification rules issued by the United States Department of Health and Human 31- 34-LS1485\N-HB 367 -14- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--Services in 45 C.F.R. Parts 160 and 164, established under the Health Insurance 1-Portability and Accountability Act of 1996 (P.L. 104-191), to the extent the provider 2-or covered entity maintains patient information in the same manner as medical 3-information or protected health information as described in (1) of this subsection; 4-(3) information collected as part of a clinical trial subject to 45 C.F.R. 5-Part 46 (Protection of Human Subjects) under 6-(A) good clinical practice guidelines issued by the International 7-Council for Harmonisation of Technical Requirements for Pharmaceuticals for 8-Human Use; or 9-(B) human subject protection requirements of the United States 10-Food and Drug Administration; 11-(4) vehicle information or ownership information retained or shared 12-between a new motor vehicle dealer, as defined in AS 45.25.990, and the motor 13-vehicle manufacturer, as defined in AS 45.25.990, if the information is shared for the 14-purpose of or in anticipation of effectuating a vehicle repair covered by a vehicle 15-warranty or recall conducted under 49 U.S.C. 30118 - 30120, if the new motor vehicle 16-dealer or vehicle manufacturer does not sell, share, or use the information for another 17-purpose; in this paragraph, 18-(A) "ownership information" means the name of each 19-registered owner and accompanying contact information; 20-(B) "vehicle information" means the vehicle identification 21-number, the vehicle's make, model, or year, or the vehicle's odometer reading; 22-(5) a person, including a subsidiary or affiliate of the person, and data 23-that are subject to 15 U.S.C. 6801 - 6827 (Gramm-Leach-Bliley Act) and related 24-regulations; 25-(6) an individual's personal information collected by a business if the 26-business collects the personal information through the individual's 27-(A) job application made to the business; 28-(B) service as an employee, officer, or director of the business; 29-or 30-(C) work as a contractor for the business and consists only of 31- 34-LS1485\N-HB0367a -15- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(i) personal information used solely within the context 1-for which it was collected; 2-(ii) emergency contact information used solely for the 3-purpose of having an emergency contact on file; or 4-(iii) personal information retained solely to administer 5-benefits for the individual. 6-(b) AS 45.48.800 - 45.48.945 do not apply to the disclosure of a consumer's 7-personal information to 8-(1) comply with federal, state, or local law; 9-(2) comply with a civil, criminal, or regulatory inquiry or an 10-investigation, subpoena, or summons by federal, state, or local authorities; 11-(3) cooperate with law enforcement agencies concerning conduct or 12-activity that the person reasonably and in good faith believes may violate federal, 13-state, or local law; 14-(4) exercise or defend legal claims; 15-(5) collect, use, retain, sell, or disclose de-identified consumer personal 16-information or aggregated consumer personal information. 17-(c) AS 45.48.800 - 45.48.945 do not apply to the collection or sale of a 18-consumer's personal information if the commercial conduct takes place wholly outside 19-the state. For the purpose of this subsection, commercial conduct takes place wholly 20-outside the state if 21-(1) the business collected the information while the consumer was 22-outside the state; the exemption allowed under this subsection does not include the 23-storage of personal information, including on a personal device, while the consumer is 24-in the state and collection when the consumer and stored information later leave the 25-state; 26-(2) no part of the sale of the consumer's personal information occurred 27-in the state; and 28-(3) no personal information collected while the consumer was in the 29-state was sold. 30-(d) AS 45.48.800 - 45.48.875 and 45.48.885 - 45.48.945 do not apply to 31- 34-LS1485\N-HB 367 -16- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--(1) an activity that is subject to 15 U.S.C. 1681 - 1681x (Fair Credit 1-Reporting Act) that involves the collection, maintenance, disclosure, sale, 2-communication, or use of any personal information bearing on a consumer's 3-creditworthiness, credit standing, credit capacity, character, general reputation, 4-personal characteristics, or mode of living by a consumer reporting agency; 5-(2) a furnisher of information who provides information for use in a 6-consumer report, or a user of a consumer report, to the extent the information is used 7-as authorized under 15 U.S.C. 1681 - 1681x (Fair Credit Reporting Act); 8-(3) personal information collected, processed, sold, or disclosed under 9-18 U.S.C. 2721 - 2725 (Driver's Privacy Protection Act of 1994) and related 10-regulations. 11-(e) Except as provided in AS 45.48.835 and 45.48.880, personal information 12-contained in a written communication, oral communication, or transaction between a 13-business and a consumer is exempt from AS 45.48.800 - 45.48.945 if 14-(1) the consumer is an individual acting as an employee, owner, 15-director, officer, member, or contractor of a sole proprietorship, partnership, limited 16-liability company, corporation, association, or other legal entity that is organized or 17-operated for the profit or financial benefit of its shareholders, partners, members, or 18-other owners, or is a government agency; in this paragraph, "owner" means an 19-individual who 20-(A) owns, directly or indirectly, or has the power to vote, more 21-than 50 percent of the outstanding shares of a class of voting securities of a 22-business; 23-(B) controls, in any manner, the election of a majority of the 24-directors or of individuals exercising similar functions; or 25-(C) has the power to exercise a controlling influence over the 26-majority of the directors or of individuals exercising similar functions; and 27-(2) the communication or transaction occurs solely within the context 28-of the business exercising due diligence regarding a product or service of, the receipt 29-of a product or service from, or providing a product or service to the corporation, 30-partnership, sole proprietorship, or government agency. 31- 34-LS1485\N-HB0367a -17- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(f) A requirement under AS 45.48.800 - 45.48.945 does not apply if 1-(1) compliance with the requirement would violate an evidentiary 2-privilege under state law; 3-(2) the business provides personal information as part of privileged 4-communication to a person covered by an evidentiary privilege; 5-(3) the right or obligation would adversely affect a right of another 6-consumer; 7-(4) the requirement would infringe on the noncommercial activity of a 8-person or entity exercising rights under art. I, sec. 5, Constitution of the State of 9-Alaska. 10-(g) A business does not sell or share a consumer's personal information under 11-AS 45.48.800 - 45.48.945 if 12-(1) the consumer intentionally directs the business to disclose the 13-consumer's personal information to a third party, intentionally uses the business to 14-disclose the consumer's personal information to a third party, or intentionally directs 15-the business to interact with a third party, and the third party does not also disclose the 16-personal information or discloses the personal information consistent with 17-AS 45.48.800 - 45.48.945; 18-(2) the business uses or shares a unique identifier for a consumer to 19-alert third parties that the consumer has requested under AS 45.48.835 that the 20-business not sell, share, or disclose the consumer's personal information or particular 21-categories of the consumer's personal information. 22-(h) A business does not sell personal information under AS 45.48.800 - 23-45.48.945 when the business uses or shares with a service provider a consumer's 24-personal information that is necessary to perform a business purpose if 25-(1) the business has provided notice under AS 45.48.800 of the 26-personal information being used or shared; and 27-(2) the service provider does not further collect, sell, or use the 28-consumer's personal information except as necessary to perform the business purpose. 29-(i) In this section, 30-(1) "contractor" means a person who is not an employee of a business 31- 34-LS1485\N-HB 367 -18- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--but provides a service to the business under a written contract; 1-(2) "covered entity" has the meaning given in 45 C.F.R. 160.103; 2-(3) "director" has the meaning given in AS 10.06.990; 3-(4) "intentionally" does not mean hovering over, muting, pausing, or 4-closing a piece of content; 5-(5) "officer" means a person appointed or designated as an officer of a 6-corporation by or under applicable law or the corporation's articles of incorporation or 7-bylaws, or a person who performs for the corporation the functions usually performed 8-by an officer of a corporation. 9-Sec. 45.48.870. Retaliation prohibited; financial incentives. (a) A business 10-may not retaliate against a consumer in response to a consumer exercising rights under 11-AS 45.48.800 - 45.48.945. Retaliation includes 12-(1) denying goods or services; 13-(2) charging different prices or rates for goods or services, including 14-using discounts or other benefits or imposing penalties; 15-(3) providing a different level or quality of goods or services to a 16-consumer; 17-(4) suggesting that a consumer will receive a different price or rate for 18-goods or services or a different level or quality of goods or services. 19-(b) Notwithstanding (a) of this section, a business may charge a consumer a 20-different rate or provide a different level or quality of goods or services to a consumer 21-if the difference is reasonably related to the value provided to the business by the 22-consumer's personal information. 23-(c) Notwithstanding (a) of this section, a business may offer a consumer a 24-financial incentive for the collection, sale, or retention of personal information, 25-including direct payments to a consumer as compensation. A business that offers a 26-financial incentive under this subsection 27-(1) shall notify consumers of the financial incentive; 28-(2) shall obtain a consumer's consent before entering a consumer into a 29-financial incentive program; to obtain a consumer's consent under this paragraph, the 30-business shall provide the consumer access to a clear and conspicuous description of 31- 34-LS1485\N-HB0367a -19- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--the material terms of the financial incentive program; the consumer may revoke the 1-consent at any time; 2-(3) may not use financial incentive practices that are unjust, 3-unreasonable, coercive, or usurious. 4-(d) In this section, "business" does not include a newspaper. 5-Sec. 45.48.875. Transfer of information in a merger, acquisition, 6-bankruptcy, and certain other transactions. (a) A business may transfer to or share 7-with a third party a consumer's personal information as an asset that is part of a 8-business change transaction. 9-(b) If a business shares a consumer's personal information with a third party in 10-the process of evaluating and consummating a business change transaction, the 11-business shall require that the third party agree by contract to keep the personal 12-information confidential and not use the personal information for a purpose other than 13-evaluating and consummating the transaction. 14-(c) A third party under (a) of this section may not use or share the consumer's 15-personal information in a manner that is materially inconsistent with (a) of this section 16-or with the uses identified in the notification made under AS 45.48.800. 17-(d) A transfer under (a) of this section does not authorize a business to make 18-material retroactive privacy policy changes or other changes in a manner that 19-constitutes an unfair or deceptive trade practice under AS 45.50.471 - 45.50.561. 20-(e) In this section, "business change transaction" means a merger, acquisition, 21-bankruptcy, or other transaction in which the third party assumes control of all or part 22-of the business. 23-Sec. 45.48.880. Duty to maintain reasonable security measures. A business 24-that owns, licenses, or maintains a consumer's personal information shall implement 25-and maintain reasonable security procedures and practices appropriate to the nature of 26-the information to protect the personal information from unauthorized access, 27-destruction, use, modification, or disclosure. 28-Sec. 45.48.885. Component parts. If a series of steps or transactions are 29-component parts of a single transaction and are intended from the beginning to avoid 30-the reach of AS 45.48.800 - 45.48.945, including a business's disclosure of 31- 34-LS1485\N-HB 367 -20- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--information to a third party to avoid being considered a sale, the steps or transactions 1-may not be considered separate for the purposes of determining compliance with, an 2-exception to, or a violation of AS 45.48.800 - 45.48.945. 3-Sec. 45.48.890. Violations. (a) A violation of AS 45.48.800 - 45.48.945 is an 4-unfair or deceptive act or practice under AS 45.50.471 - 45.50.561. Each day of a 5-violation constitutes a separate violation. 6-(b) In an action brought under AS 45.50.531(a), a consumer whose personal 7-information is subjected to unauthorized access, destruction, use, modification, or 8-disclosure has suffered an ascertainable loss of $1 or another amount proven at trial, 9-whichever is greater. 10-(c) The remedies under this section are in addition to the remedies provided 11-under AS 45.48.080 for a violation of AS 45.48.010 - 45.48.090. 12-Sec. 45.48.895. Consumer privacy account. (a) The consumer privacy 13-account is established as a separate account in the general fund. 14-(b) The consumer privacy account consists of 15-(1) money appropriated to the account by the legislature; 16-(2) the registration fees collected under AS 45.48.900(b)(2); 17-(3) the fees collected under AS 45.48.910; and 18-(4) civil penalties and money collected in or as a result of an action 19-brought by the attorney general under AS 45.48.800 - 45.48.945. 20-(c) The purposes of the consumer privacy account are to pay 21-(1) the salaries of attorneys in the Department of Law that enforce the 22-provisions of AS 45.48.800 - 45.48.945 at an amount that is competitive with the 23-private sector; and 24-(2) the administrative costs incurred by the department and the 25-Department of Law to enforce AS 45.48.800 - 45.48.945. 26-(d) The legislature may appropriate money deposited under (b)(2) - (4) of this 27-section for the purposes of the account. 28-Sec. 45.48.900. Data broker registration. (a) Before a business begins 29-operating as a data broker, the business shall register with the commissioner in 30-accordance with this section. 31- 34-LS1485\N-HB0367a -21- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(b) To register as a data broker, a business shall 1-(1) provide, on a form provided by the commissioner, 2-(A) the name of the data broker; 3-(B) the data broker's primary physical and mailing addresses; 4-(C) the data broker's electronic mailing address; 5-(D) the data broker's primary Internet website address; and 6-(E) the data broker's "Do Not Collect or Sell My Personal 7-Information" Internet website page as required under AS 45.48.800(c) or 8-alternative Internet website page that meets the requirements of 9-AS 45.48.800(d); and 10-(2) pay a registration fee in an amount established by the department 11-by regulation. 12-(c) The department shall deposit the fees paid under (b)(2) of this section into 13-the consumer privacy account established under AS 45.48.895. 14-Sec. 45.48.905. Data broker registry publicly displayed. The commissioner 15-shall make the information provided by data brokers under AS 45.48.900(b)(1) 16-available on the department's Internet website. 17-Sec. 45.48.910. Revenue fees. (a) A business that collects, sells, or shares 18-personal information from a consumer shall pay a fee to the department. The amount 19-of this fee is three percent of the revenue received by the business from the buying, 20-selling, or sharing of the personal information of a consumer or household 21-information. 22-(b) The department shall deposit the fees paid under (a) of this section into the 23-consumer privacy account established under AS 45.48.895. 24-Sec. 45.48.915. Regulations. (a) The attorney general shall adopt regulations 25-under AS 44.62 (Administrative Procedure Act) that 26-(1) create specific exceptions required to comply with state or federal 27-law; 28-(2) govern the Internet website page requirement of AS 45.48.800, 29-including 30-(A) the use of a recognizable and uniform mark to identify the 31- 34-LS1485\N-HB 367 -22- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--opportunity to exercise a right under AS 45.48.800 - 45.48.945; 1-(B) the submission of a consumer request; 2-(C) a business's compliance with a request under AS 45.48.835; 3-(3) update, as necessary, additional categories of personal information 4-required to be disclosed in response to relevant changes in technology, data collection 5-practices, privacy concerns, or obstacles to implementation; 6-(4) update, as necessary, the interpretation of unique identifiers in 7-response to relevant changes in technology, data collection practices, privacy 8-concerns, or obstacles to implementation; 9-(5) update, as necessary, the interpretation of designated methods for 10-submitting requests to facilitate a consumer's ability to obtain information from a 11-business; 12-(6) establish requirements to ensure that notices and information 13-provided under AS 45.48.800 are in plain language, accessible to consumers with 14-disabilities, and available in the language primarily used by the business to interact 15-with the consumer, including with regard to financial incentive offerings; 16-(7) designate the process for a consumer to authorize a representative 17-to exercise the rights provided under AS 45.48.800 - 45.48.945 on the consumer's 18-behalf; and 19-(8) further define the meaning of "profile." 20-(b) The attorney general may adopt regulations under AS 44.62 21-(Administrative Procedure Act) that 22-(1) establish rules and procedures for processing and complying with a 23-consumer request for specific pieces of personal information relating to a household to 24-address obstacles to implementation and privacy concerns; 25-(2) state that service providers may combine personal information for 26-specified purposes; 27-(3) are necessary to further the purposes of AS 45.48.800 - 45.48.945. 28-(c) The department shall establish by regulation adopted under AS 44.62 29-(Administrative Procedure Act) the amount of the registration fee that a data broker 30-shall pay under AS 45.48.900(b)(2). 31- 34-LS1485\N-HB0367a -23- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--Sec. 45.48.920. Persons who may consent. Except as provided in 1-AS 45.48.845(a), a person may provide consent for a consumer under AS 45.48.800 - 2-45.48.945 if the person is 3-(1) the consumer; 4-(2) the consumer's legal guardian; 5-(3) a person who holds a power of attorney for the consumer; or 6-(4) a person who is acting as a conservator for the consumer. 7-Sec. 45.48.925. Personnel training. A business subject to AS 45.48.800 - 8-45.48.945 shall provide training to individuals responsible for handling consumer 9-questions or requests under AS 45.48.800 - 45.48.945, including training the 10-individuals how to direct a consumer to exercise the consumer's rights under 11-AS 45.48.800 - 45.48.945. 12-Sec. 45.48.930. Provisions not waivable. A consumer's waiver of the 13-provisions of AS 45.48.800 - 45.48.945 is contrary to public policy and is 14-unenforceable and void. This section does not prevent a consumer from 15-(1) declining to request information from a business; 16-(2) declining to request that a business not collect, sell, or disclose the 17-consumer's personal information; or 18-(3) authorizing a business to sell the consumer's personal information 19-after previously requesting that the business not sell the personal information. 20-Sec. 45.48.935. Liberal construction. The intent of AS 45.48.800 - 45.48.945 21-is remedial and its provisions shall be liberally construed. 22-Sec. 45.48.940. Definitions. In AS 45.48.800 - 45.48.945, unless the context 23-indicates otherwise, 24-(1) "aggregated consumer information" means information that relates 25-to a group or category of consumers from which individual consumer identities have 26-been removed, and that is not linked or reasonably linkable by a device or other 27-method to a consumer or household; "aggregated consumer information" does not 28-mean an individual consumer record that has been de-identified; 29-(2) "application" means a computer software package that performs a 30-specific function; 31- 34-LS1485\N-HB 367 -24- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--(3) "beacon" means a small computer device that allows computer 1-information to be transmitted to a portable device that can connect to the Internet; 2-(4) "business" means a sole proprietorship, partnership, limited 3-liability company, corporation, association, or other legal entity that is organized or 4-operated for the profit or financial benefit of its shareholders, partners, members, or 5-other owners, that collects or has collected consumers' personal information or on the 6-behalf of which that information is collected, that alone or jointly with others 7-determines the purposes and means of processing personal information of consumers, 8-that does business in the state, and that 9-(A) satisfies one or both of the following thresholds: 10-(i) alone or in combination with another person, 11-annually buys, sells, or shares the personal information of 100,000 or 12-more consumers or households; or 13-(ii) derives 50 percent or more of its annual revenue 14-from selling or sharing the personal information of consumers; or 15-(B) controls or is controlled by a business that meets a 16-threshold in (A) of this paragraph and shares a name, service mark, trademark, 17-or other form of common branding with the business; in this subparagraph, 18-"control" means 19-(i) ownership or the power to vote more than 50 percent 20-of the outstanding shares of any class of voting security of a business; 21-(ii) control, in any manner, of the election of a majority 22-of the directors or of individuals exercising similar functions; or 23-(iii) the power to exercise a controlling influence over 24-the majority of the directors or of individuals exercising similar 25-functions; 26-(5) "business purpose" means a use for an operational purpose or other 27-notified purpose, if the use is reasonably necessary and proportionate to achieving the 28-operational purpose or other notified purpose for which personal information was 29-collected or processed, or is a compatible use; 30-(6) "categories of personal information" includes a category of 31- 34-LS1485\N-HB0367a -25- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--personal information set out in (24) of this section and a category of personal 1-information not specifically enumerated; 2-(7) "collect" includes buying, renting, gathering, obtaining, receiving, 3-or accessing personal information pertaining to a consumer by actively or passively 4-receiving information from the consumer, by observing the consumer's behavior, or by 5-any other means; 6-(8) "commercial purpose" includes marketing, advertising, and any 7-other purpose that advances a person's commercial or economic interests, except 8-engaging in political speech, journalism, or other speech that state or federal courts 9-have recognized as noncommercial speech; 10-(9) "commissioner" means the commissioner of commerce, 11-community, and economic development; 12-(10) "compatible use" means 13-(A) auditing related to a current interaction with the consumer 14-and counting the advertisement impressions made to individual visitors, 15-verifying positioning and quality of advertisement impressions, and auditing 16-compliance with this paragraph, other standards, and other concurrent 17-transactions; 18-(B) detecting security incidents, protecting against malicious, 19-deceptive, fraudulent, or illegal activity, and prosecuting those persons 20-responsible for that activity; 21-(C) identifying and removing errors from computer hardware 22-or software that impair existing intended functionality; 23-(D) the contextual customization of advertisements shown as 24-part of the same interaction and other short-term transient use, if the personal 25-information is not disclosed to a third party and is not used to build a profile 26-about a consumer or alter the experience of an individual consumer outside the 27-current interaction; 28-(E) maintaining or servicing accounts, providing customer 29-service, processing or fulfilling orders and transactions, verifying customer 30-information, processing payments, providing financing, providing advertising 31- 34-LS1485\N-HB 367 -26- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--or marketing services, providing analytical services, and performing other 1-services on behalf of the business or service provider; 2-(F) conducting internal research for technological development 3-and demonstration; 4-(G) performing activities to verify or maintain the quality or 5-safety of a service or device that is owned by, manufactured by, manufactured 6-for, or controlled by the business, and to improve, upgrade, or enhance the 7-service or device; or 8-(H) performing another use that is consistent with the context 9-in which the personal information was collected; 10-(11) "consent" 11-(A) means a consumer's freely given, specific, informed, and 12-unambiguous indication by statement, action, or other method, that the 13-consumer agrees to the processing of the consumer's personal information for a 14-narrowly defined purpose; 15-(B) does not mean 16-(i) acceptance of general terms of use, a broad statement 17-of terms of use, or a similar document that contains descriptions of 18-personal information processing along with other, unrelated 19-information; 20-(ii) hovering over, muting, pausing, or closing a given 21-piece of content on the Internet; or 22-(iii) an agreement obtained through the use of a user 23-interface designed or manipulated to subvert or impair user autonomy, 24-decision making, or choice; 25-(12) "conservator" has the meaning given in AS 13.06.050; 26-(13) "consumer" means an individual who is a resident of the state 27-under AS 01.10.055, whether identified by a unique identifier or other method of 28-identification, but does not mean an individual acting 29-(A) as an employee, owner, director, officer, member, or 30-contractor or in another capacity of a corporation, limited liability company, 31- 34-LS1485\N-HB0367a -27- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--sole proprietorship, partnership, association, nonprofit, or other entity or 1-government agency; 2-(B) for the entity or agency with another entity or agency; or 3-(C) in an employment context; 4-(14) "consumer request" means a request that is made by a consumer, 5-by a parent or legal guardian with legal custody of the consumer, or by a individual or 6-a person registered with the United States Secretary of State, authorized by the 7-consumer to act on the consumer's behalf; 8-(15) "data broker" means a business that knowingly collects and sells 9-to third parties the personal information of a consumer with whom the business does 10-not have a direct relationship, but does not include a consumer reporting agency to the 11-extent the agency is covered by 15 U.S.C. 1681 et seq. (Fair Credit Reporting Act); 12-(16) "de-identified" means that the information cannot reasonably 13-identify, relate to, describe, be capable of being associated with, or be directly or 14-indirectly linked to, an individual consumer, and the business holding the information 15-(A) has implemented technical safeguards that prohibit re-16-identification of the consumer to whom the information may pertain; 17-(B) has implemented business processes that specifically 18-prohibit re-identification of the information; 19-(C) has implemented business processes to prevent inadvertent 20-release of de-identified information; and 21-(D) makes no attempt to re-identify the information; 22-(17) "department" means the Department of Commerce, Community, 23-and Economic Development; 24-(18) "device" includes a computer and a physical object that can 25-(A) read, write, or store information that is represented in 26-numerical form; 27-(B) connect to the Internet, directly or indirectly, or to another 28-device; 29-(19) "disclose" includes all types of disclosure, including the 30-disclosure of personal information related to a sale of personal information; 31- 34-LS1485\N-HB 367 -28- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--(20) "Internet website page" means a document accessible through the 1-Internet with a unique identifier used to locate a resource on the Internet; 2-(21) "knowingly" has the meaning given in AS 11.81.900(a); 3-(22) "operational purpose" means the use of personal information, 4-when reasonably necessary and proportionate, to achieve, if the use is limited to a 5-direct relationship and experience with a consumer, 6-(A) debugging to identify and repair errors that impair existing 7-intended functions; 8-(B) based on information collected by the business, 9-undertaking internal research for analysis, product improvement, and 10-technology development; 11-(C) verification or maintenance of the quality or safety of a 12-service or device that is owned, manufactured, manufactured for, or controlled 13-by the business, or to improve, upgrade, or enhance a service or device that is 14-owned, manufactured, manufactured for, or controlled by the business; 15-(D) customization of content based on information collected by 16-the business; or 17-(E) customization of advertising or marketing based on 18-information collected by the business; 19-(23) "person" means an individual, proprietorship, corporation, 20-company, partnership, firm, association, and any other nongovernmental organization 21-or group of persons acting in concert; 22-(24) "personal information" 23-(A) means the information in the following categories that 24-identifies, relates to, describes, is reasonably capable of being associated with, 25-or could reasonably be linked, directly or indirectly, with a particular consumer 26-or household: 27-(i) a real name, alias, postal address, unique identifier, 28-online identifier, Internet protocol address, electronic mail address, 29-account name, or other identifier; 30-(ii) signature; 31- 34-LS1485\N-HB0367a -29- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(iii) physical characteristics or physical description; 1-(iv) telephone number; 2-(v) insurance policy number; 3-(vi) characteristics of protected classifications under 4-state or federal law; 5-(vii) commercial information, including bank accounts, 6-records of personal property, products or services purchased, obtained, 7-or considered, or other purchasing or consuming histories or 8-tendencies; 9-(viii) browsing history, search history, and information 10-regarding a consumer's interaction with an Internet website, 11-application, or advertisement, or other Internet or electronic network 12-activity information; 13-(ix) geolocation data, including precise geolocation 14-data; 15-(x) audio, electronic, visual, thermal, olfactory, or 16-similar information; 17-(xi) professional or employment-related information; 18-(xii) information that is personally identifiable 19-information, as defined in 34 C.F.R. 99.3, that is not publicly available; 20-(xiii) sensitive personal information; 21-(xiv) inferences drawn from any of the information 22-identified in this subparagraph to create a profile about a consumer 23-reflecting the consumer's preferences, characteristics, psychological 24-trends, predispositions, behavior, attitudes, intelligence, abilities, and 25-aptitudes; 26-(B) does not mean 27-(i) publicly available information; 28-(ii) consumer information that is de-identified or is 29-aggregated consumer information; 30-(iii) biometric information; in this sub-subparagraph, 31- 34-LS1485\N-HB 367 -30- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--"biometric information" means an individual's physiological, 1-biological, or behavioral characteristics that can be used to establish 2-individual identity; 3-(25) "precise geolocation data" 4-(A) means data that is derived from a consumer device through 5-a technology that 6-(i) is capable of determining with specificity the latitude 7-and longitude coordinates or other spatial location of a person or 8-device; 9-(ii) has an accuracy level of less than 1,750 feet; 10-(iii) uses a global positioning system, a triangulated 11-location provided by a beacon, network radios, or a technology that 12-allows computers, mobile phones, or other devices to connect to the 13-Internet or communicate with one another wirelessly within a particular 14-area, or another technology; 15-(B) does not mean information that is or will be 16-(i) altered before the information is processed, in order 17-to be able to determine with specificity the physical location of an 18-individual or device; 19-(ii) used by a business when acting as an employer; 20-(26) "processing" means any operation or set of operations performed 21-on personal data or on sets of personal data, whether or not by automated means; 22-(27) "profile" or "profiling" means automated processing of personal 23-information, as further defined by regulation adopted under AS 45.48.915, to analyze 24-or predict an individual's work performance, economic situation, health, personal 25-preferences, interests, reliability, behavior, location, movements, or other personal 26-features; 27-(28) "publicly available information" means information that is 28-lawfully made available from federal, state, or local government records, that a 29-business has a reasonable basis to believe is lawfully made available to the general 30-public by the consumer or from widely distributed media, or that a consumer makes 31- 34-LS1485\N-HB0367a -31- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--available by a person to whom the consumer has disclosed the information if the 1-consumer has not restricted the information to a specific audience; 2-(29) "research" means scientific systematic study and observation that 3-is in the public interest, that adheres to all applicable ethics and privacy laws, and 4-(A) is compatible with the business purpose for which the 5-personal information was collected; 6-(B) is used solely for research purposes that are compatible 7-with the context in which the personal information was collected; 8-(C) is not used for a commercial purpose; and 9-(D) in which the personal information is 10-(i) later pseudonymized and de-identified, or de-11-identified and in the aggregate, if the information cannot reasonably 12-identify, relate to, describe, be capable of being associated with, or be 13-linked, directly or indirectly, to a particular consumer; personal 14-information is considered pseudonymized if the information is 15-processed so that it is no longer attributable to a specific consumer 16-without the use of additional information, and the additional 17-information is kept separate and is subject to technical and 18-organizational measures to ensure that the personal information is not 19-attributed to an identified or identifiable consumer; 20-(ii) subject to technical safeguards that prohibit re-21-identification of the consumer to whom the information may pertain; 22-(iii) subject to business processes that specifically 23-prohibit re-identification of the information; 24-(iv) subject to business processes to prevent inadvertent 25-release of de-identified information; and 26-(v) subjected by the business conducting the research to 27-additional security controls that limit access to the research data to 28-individuals in the business as necessary to carry out the research 29-purpose; 30-(30) "sale," "sell," or "sold" means renting, releasing, disclosing, 31- 34-LS1485\N-HB 367 -32- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--disseminating, making available, transferring, or otherwise communicating orally, in 1-writing, or by electronic or other means, a consumer's personal information by a 2-business to a third party for monetary or other valuable consideration or for another 3-commercial purpose; 4-(31) "sensitive personal information" means information that is not 5-publicly available information and reveals 6-(A) a consumer's social security number, driver's license 7-number, known traveler number, state identification card number, passport 8-number, or other unique identification number issued on a government 9-document commonly used to verify the identity of a specific individual; 10-(B) the number of a consumer's Internet account, financial 11-account, debit card account, credit card account, or other account, in 12-combination with any required security or access code, password, or 13-credentials allowing access to the account; 14-(C) a consumer's precise geolocation; 15-(D) a consumer's racial or ethnic origin, religious or 16-philosophical beliefs, mental or physical health diagnosis, sexual orientation, 17-citizenship or immigration status, or union membership; 18-(E) the contents of a consumer's mail or electronic mail, text 19-message, or other electronic communication, unless the business possessing the 20-information is the intended recipient of the communication; 21-(F) a consumer's genetic data; 22-(G) information about an individual who is less than 18 years 23-of age; 24-(H) information collected and analyzed concerning a 25-consumer's health; or 26-(I) information collected and analyzed about a consumer's 27-sexual life or sexual orientation; 28-(32) "service provider" means a person that receives personal 29-information from a business to be used solely for a business purpose under a written 30-contract that requires the service provider to comply with AS 45.48.860; 31- 34-LS1485\N-HB0367a -33- HB 367- New Text Underlined [DELETED TEXT BRACKETED]--(33) "share" means renting, releasing, disclosing, disseminating, 1-making available, transferring, or otherwise communicating orally, in writing, or by 2-electronic or other means personal information by a business to a third party for 3-cross‐context behavioral advertising, whether for monetary or other valuable 4-consideration, or in a transaction between a business and a third party for 5-cross‐context behavioral advertising for the benefit of a business in which no money is 6-exchanged; in this paragraph, "cross-context behavioral advertising" means the 7-targeting of advertising to a consumer based on the consumer's personal information 8-obtained from the consumer's activity across businesses, distinctly branded Internet 9-websites, applications, or services, other than the business, distinctly branded website, 10-application, or service with which the consumer intentionally interacts; 11-(34) "third party" means any person, except 12-(A) the business that collected the personal information from 13-the consumer; and 14-(B) a service provider contracting with the business that 15-collected the personal information from the consumer; 16-(35) "unique identifier" includes a device identifier; an Internet 17-protocol address; cookies, beacons, pixel tags, mobile ad identifiers, or similar 18-technology; customer number, unique pseudonym, or user alias; telephone numbers, or 19-other forms of persistent or probabilistic identifiers that can be used to identify a 20-particular consumer or device; or another persistent identifier that can be used to 21-recognize a consumer, a household, or a device that is linked to a consumer or 22-household, over time and across different services; in this paragraph, 23-(A) "cookie" means information from an Internet website 24-stored by a person's computer that is used to identify the person's computer 25-while the person is using the website; 26-(B) "pixel tag" means a small design or picture that is loaded 27-when a computer user visits an Internet website page or opens electronic mail; 28-(C) "probabilistic identifier" means the identification of a 29-consumer or a device to a degree of certainty of more probable than not based 30-on a category of personal information included in, or similar to, the categories 31- 34-LS1485\N-HB 367 -34- HB0367a- New Text Underlined [DELETED TEXT BRACKETED]--of personal information. 1-Sec. 45.48.945. Short title. AS 45.48.800 - 45.48.945 may be cited as the 2-Consumer Personal Information Privacy Act. 3- * Sec. 5. AS 45.50.471(b) is amended by adding a new paragraph to read: 4-(58) violating AS 45.48.800 - 45.48.945 (Consumer Personal 5-Information Privacy Act). 6- * Sec. 6. The uncodified law of the State of Alaska is amended by adding a new section to 7-read: 8-APPLICABILITY: CONTRACTS. This Act applies to a contract entered into on or 9-after the effective date of secs. 1 - 6 of this Act. 10- * Sec. 7. The uncodified law of the State of Alaska is amended by adding a new section to 11-read: 12-TRANSITION: REGULATIONS. The attorney general shall adopt regulations as 13-authorized under AS 45.48.915, added by sec. 4 of this Act, to implement the changes made 14-by this Act. The regulations take effect under AS 44.62 (Administrative Procedure Act), but 15-not before the effective date of the law implemented by the regulation. 16- * Sec. 8. Section 7 of this Act takes effect immediately under AS 01.10.070(c). 17- * Sec. 9. Except as provided in sec. 8 of this Act, this Act takes effect January 1, 2027. 18+Unique in the Crowd: The privacy bounds+of human mobility+Yves-Alexandre de Montjoye 1,2,C e´sar A. Hidalgo 1,3,4, Michel Verleysen 2 & Vincent D. Blondel 2,5+1Massachusetts Institute of Technology, Media Lab, 20 Ames Street, Cambridge, MA 02139 USA,2Universite´ catholique de+Louvain, Institute for Information and Communication Technologies, Electronics and Applied Mathematics, Avenue Georges+Lemaıˆtre 4, B-1348 Louvain-la-Neuve, Belgium,3Harvard University, Center for International Development, 79 JFK Street,+Cambridge, MA 02138, USA, 4Instituto de Sistemas Complejos de Valparaı´so, Paseo 21 de Mayo, Valparaı´so, Chile,+5Massachusetts Institute of Technology, Laboratory for Information and Decision Systems, 77 Massachusetts Avenue, Cambridge,+MA 02139, USA.+We study fifteen months of human mobility data for one and a half million individuals and find that human+mobility traces are highly unique. In fact, in a dataset where the location of an individual is specified hourly,+and with a spatial resolution equal to that given by the carrier’s antennas, four spatio-temporal points are+enough to uniquely identify 95% of the individuals. We coarsen the data spatially and temporally to find a+formula for the uniqueness of human mobility traces given their resolution and the available outside+information. This formula shows that the uniqueness of mobility traces decays approximately as the 1/10+power of their resolution. Hence, even coarse datasets provide little anonymity. These findings represent+fundamental constraints to an individual’s privacy and have important implications for the design of+frameworks and institutions dedicated to protect the privacy of individuals.+D+erived from the Latin Privatus, meaning ‘‘withdraw from public life,’’ the notion of privacy has been+foundational to the development of our diverse societies, forming the basis for individuals’ rights such as+free speech and religious freedom 1. Despite its importance, privacy has mainly relied on informal pro-+tection mechanisms. For instance, tracking individuals’ movements has been historically difficult, making them+de-facto private. For centuries, information technologies have challenged these informal protection mechanisms.+In 1086, William I of England commissioned the creation of the Doomsday book, a written record of major+property holdings in England containing individual information collected for tax and draft purposes 2. In the late+19th century, de-facto privacy was similarly threatened by photographs and yellow journalism. This resulted in+one of the first publications advocating privacy in the U.S. in which Samuel Warren and Louis Brandeis argued+that privacy law must evolve in response to technological changes 3.+Modern information technologies such as the Internet and mobile phones, however, magnify the uniqueness of+individuals, further enhancing the traditional challenges to privacy. Mobility data is among the most sensitive+data currently being collected. Mobility data contains the approximate whereabouts of individuals and can be+used to reconstruct individuals’ movements across space and time. Individual mobility traces T [Fig. 1A–B] have+been used in the past for research purposes4–18 and to provide personalized services to users19. A list of potentially+sensitive professional and personal information that could be inferred about an individual knowing only his+mobility trace was published recently by the Electronic Frontier Foundation20. These include the movements of a+competitor sales force, attendance of a particular church or an individual’s presence in a motel or at an abortion+clinic.+While in the past, mobility traces were only available to mobile phone carriers, the advent of smartphones and+other means of data collection has made these broadly available. For example, AppleH recently updated its privacy+policy to allow sharing the spatio-temporal location of their users with ‘‘partners and licensees’’ 21. 65.5B geo-+tagged payments are made per year in the US 22 while Skyhook wireless is resolving 400 M user’s WiFi location+every day23. Furthermore, it is estimated that a third of the 25B copies of applications available on Apple’s App+StoreSM access a user’s geographic location24,25, and that the geo-location of ,50% of all iOS and Android traffic is+available to ad networks 26. All these are fuelling the ubiquity of simply anonymized mobility datasets and are+giving room to privacy concerns.+A simply anonymized dataset does not contain name, home address, phone number or other obvious identifier.+Yet, if individual’s patterns are unique enough, outside information can be used to link the data back to an+individual. For instance, in one study, a medical database was successfully combined with a voters list to extract+SUBJECT AREAS:+APPLIED PHYSICS+APPLIED MATHEMATICS+STATISTICS+COMPUTATIONAL SCIENCE+Received+1 October 2012+Accepted+4 February 2013+Published+25 March 2013+Correspondence and+requests for materials+should be addressed to+Y.-A. de M. (yva@mit.+edu)+SCIENTIFIC REPORTS | 3 : 1376 | DOI: 10.1038/srep01376 1+the health record of the governor of Massachusetts 27. In another,+mobile phone data have been re-identified using users’ top loca-+tions28. Finally, part of the Netflix challenge dataset was re-identified+using outside information from The Internet Movie Database 29.+All together, the ubiquity of mobility datasets, the uniqueness of+human traces, and the information that can be inferred from them+highlight the importance of understanding the privacy bounds of+human mobility. We show that the uniqueness of human mobility+traces is high and that mobility datasets are likely to be re-identifiable+using information only on a few outside locations. Finally, we show+that one formula determines the uniqueness of mobility traces pro-+viding mathematical bounds to the privacy of mobility data. The+uniqueness of traces is found to decrease according to a power func-+tion with an exponent that scales linearly with the number of known+spatio-temporal points. This implies that even coarse datasets pro-+vide little anonymity.+Results+Uniqueness of human mobility . In 1930, Edmond Locard showed+that 12 points are needed to uniquely identify a fingerprint 30. Our+unicity test estimates the number of points p needed to uniquely+identify the mobility trace of an individual. The fewer points+needed, the more unique the traces are and the easier they would+be to re-identify using outside information. For re-identification+purposes, outside observations could come from any publicly+available information, such as an individual’s home address,+workplace address, or geo-localized tweets or pictures. To the best+of our knowledge, this is the first quantification of the uniqueness of+human mobility traces with random points in a sparse, simply+anonymized mobility dataset of the scale of a small country.+Given Ip, a set of spatio-temporal points, and D, a simply anon-+ymized mobility dataset, we evaluate e, the uniqueness of traces, by+extracting from D the subset of trajectories S( Ip) that match the p+points composing Ip [See Methods]. A trace is unique if jS(Ip)j 5 1,+containing only one trace. For example, in Fig. 2A, we evaluate the+uniqueness of traces given Ip52. The two spatio-temporal points+contained in Ip52 are zone I from 9am to 10am and zone II from+12pm to 1pm. The red and the green traces both satisfy Ip52, making+them not unique. However, we can also evaluate the uniqueness of+traces knowing Ip53, adding as a third point zone III between 3pm+and 4pm. In this case jS(Ip53)j 5 1, uniquely characterize the green+trace. A lower bound on the risk of deductive disclosure of a user’s+identity is given by the uniqueness of his mobility trace, the like-+lihood of this brute force characterization to succeed.+Our dataset contains 15 months of mobility data for 1.5 M people,+a significant and representative part of the population of a small+European country, and roughly the same number of users as the+location-based service FoursquareH31.J u s ta sw i t hs m a r t p h o n ea p p l i -+cations or electronic payments, the mobile phone operator records+the interactions of the user with his phone. This creates a comparable+longitudinally sparse and discrete database [Fig. 3]. On average, 114+interactions per user per month for the nearly 6500 antennas are+recorded. Antennas in our database are distributed throughout the+country and serve, on average, , 2000 inhabitants each, covering+areas ranging from 0.15 km+2 in cities to 15 km 2 in rural areas. The+number of antennas is strongly correlated with population density+(R+2 5 .6426) [Fig. 3C]. The same is expected from businesses, places+in location-based social networks, or WiFi hotspots.+Fig. 2B shows the fraction of unique traces ( e) as a function of the+number of available points p. Four randomly chosen points are+enough to uniquely characterize 95% of the users ( e . .95), whereas+two randomly chosen points still uniquely characterize more than+50% of the users ( e . .5). This shows that mobility traces are highly+unique, and can therefore be re-identified using little outside+information.+Scaling properties . Nonetheless, e depends on the spatial and+temporal resolution of the dataset. Here, we determine this depen-+dence by lowering the resolution of our dataset through spatial and+temporal aggregation [Fig. 1C]. We do this by increasing the size of a+region, aggregating neighbouring cells into clusters of v cells, or by+reducing the dataset’s temporal resolution, increasing the length of+the observation time window to h hours [see Methods]. Both of these+aggregations are bound to decrease e, and therefore, make re-+identification harder.+Fig. 4A shows how the uniqueness of mobility traces e depends on+the spatial and temporal resolution of the data. This reduction, how-+ever, is quite gradual. Given four points (p 54), we find that e . .5+when using a resolution of h 5 5 hours and v 5 5 antennas.+Statistically, we find that traces are more unique when coarse on+one dimension and fine along another than when they are medium-+grained along both dimensions. Indeed, given four points, e . .6 in a+dataset with a temporal resolution of h 5 15 hours or a spatial+resolution of v 5 15 antennas while e . .4 in a dataset with a+temporal resolution of h 5 7 hours and a spatial resolution of v 5+7 antennas [Fig. 4A].+Next, we show that it is possible to find one formula to estimate the+uniqueness of traces given both, the spatial and temporal resolution+of the data, and the number of points available to an outside observer.+Fig. 4B and 4C show that the uniqueness of a trace decreases as the+power function e 5 a 2 x+b, for decreases in both the spatial and+temporal resolution (x), and for all considered p 5 4, 6, 8 and 10 (see+Table S1). The uniqueness of human mobility can thus be expressed+using the single formula: e 5 a 2 (nh)+b. We find that this power+AB C+Antenna+Phone+activity+Figure 1 | (A) Trace of an anonymized mobile phone user during a day. The dots represent the times and locations where the user made or received a call.+Every time the user has such an interaction, the closest antenna that routes the call is recorded. (B) The same user’s trace as recorded in a mobility database.+The Voronoi lattice, represented by the grey lines, are an approximation of the antennas reception areas, the most precise location information available to+us. The user’s interaction times are here recorded with a precision of one hour. (C) The same individual’s trace when we lower the resolution of our dataset+through spatial and temporal aggregation. Antennas are aggregated in clusters of size two and their associated regions are merged. The user’s interaction+are recorded with a precision of two hours. Such spatial and temporal aggregation render the 8:32 am and 9:15 am interactions indistinguishable.+www.nature.com/ scientificreports+SCIENTIFIC REPORTS | 3 : 1376 | DOI: 10.1038/srep01376 2+function fits the data better than other two-parameters functions+such as a 2 exp ( lx), a stretched exponential a 2 exp xb,o ra+standard linear function a 2 bx (see Table S1). Both estimators for+a and b are highly significant (p , 0.001)32, and the mean pseudo-R2+is 0.98 for the Ip54 case and the Ip510 case. The fit is good at all levels+of spatial and temporal aggregation [Fig. S3A–B].+The power-law dependency of e means that, on average, each time+the spatial or temporal resolution of the traces is divided by two, their+uniqueness decreases by a constant factor , (2)+2b. This implies that+privacy is increasingly hard to gain by lowering the resolution of a+dataset.+Fig. 2B shows that, as expected, e increases with p. The mitigating+effect of p on e is mediated by the exponent b which decays linearly+with p: b 5 0.157 2 0.007p [Fig. 4E]. The dependence of b on p+implies that a few additional points might be all that is needed to+identify an individual in a dataset with a lower resolution. In fact,+given four points, a two-fold decrease in spatial or temporal resolu-+tion makes it 9.3% less likely to identify an individual, while given ten+points, the same two-fold decrease results in a reduction of only 6.2%+(see Table S1).+Because of the functional dependency of e on p through the expo-+nent b, mobility datasets are likely to be re-identifiable using+information on only a few outside locations.+Discussion+Our ability to generalize these results to other mobility datasets+depends on the sensitivity of our analysis to extensions of the data+to larger populations, or geographies. An increase in population+density will tend to decrease e. Yet, it will also be accompanied by+an increase in the number of antennas, businesses or WiFi hotspots+used for localizations. These effects run opposite to each other, and+therefore, suggest that our results should generalize to higher popu-+lation densities.+Extensions of the geographical range of observation are also+unlikely to affect the results as human mobility is known to be highly+circumscribed. In fact, 94% of the individuals move within an average+radius of less than 100 km+17. This implies that geographical exten-+sions of the dataset will stay locally equivalent to our observations,+making the results robust to changes in geographical range.+From an inference perspective, it is worth noticing that the spatio-+temporal points do not equally increase the likelihood of uniquely+identifying a trace. Furthermore, the information added by a point is+highly dependent from the points already known. The amount of+information gained by knowing one more point can be defined as the+reduction of the cardinality of S( I+p) associated with this extra point.+The larger the decrease, the more useful the piece of information is.+Intuitively, a point on the MIT campus at 3AM is more likely to+make a trace unique than a point in downtown Boston on a Friday+evening.+This study is likely to underestimate e, and therefore the ease of re-+identification, as the spatio-temporal points are drawn at random+from users’ mobility traces. Our I+p are thus subject to the user’s+spatial and temporal distributions. Spatially, it has been shown that+the uncertainty of a typical user’s whereabouts measured by its+Figure 2 | (A) Ip52 means that the information available to the attacker consist of two 7am-8am spatio-temporal points (I and II). In this case, the target+was in zone I between 9am to 10am and in zone II between 12pm to 1pm. In this example, the traces of two anonymized users (red and green) are+compatible with the constraints defined by Ip52. The subset S(Ip52) contains more than one trace and is therefore not unique. However, the green trace+would be uniquely characterized if a third point, zone III between 3pm and 4pm, is added (Ip53). (B) The uniqueness of traces with respect to the number+p of given spatio-temporal points (Ip). The green bars represent the fraction of unique traces, i.e.| S(Ip) | 5 1. The blue bars represent the fraction of | S(Ip) |+# 2. Therefore knowing as few as four spatio-temporal points taken at random (Ip54) is enough to uniquely characterize 95% of the traces amongst 1.5 M+users. (C) Box-plot of the minimum number of spatio-temporal points needed to uniquely characterize every trace on the non-aggregated database. At+most eleven points are enough to uniquely characterize all considered traces.+10 6+10 5+10 4+10 3+10 0 10 1 10 2 10 3+Number of antennas+Inhabitants+Probability density function+Median inter-interactions time per user [h]+0 12 24 36 48 60 72 84 96+10 0+10 -1+10 -2+10 -3+10 -4+10 0+10 -1+10 -2+10 -3+10 -4+10 -5+ 0 500 1000 1500 2000 2500+Number of interactions+Probability density function+A BC+Figure 3 | (A) Probability density function of the amount of recorded spatio-temporal points per user during a month. (B) Probability density function+of the median inter-interaction time with the service. (C) The number of antennas per region is correlated with its population (R 2 5 .6426). These plots+strongly emphasize the discrete character of our dataset and its similarities with datasets such as the one collected by smartphone apps.+www.nature.com/ scientificreports+SCIENTIFIC REPORTS | 3 : 1376 | DOI: 10.1038/srep01376 3+entropy is 1.74, less than two locations 18. This makes our random+choices of points likely to pick the user’s top locations (typically+‘‘home’’ and ‘‘office’’). Temporally, the distribution of calls during+the week is far from uniform [Fig. S1] which makes our random+choice more likely to pick a point at 4PM than at 3AM. However,+even in this case, the traces we considered that are most difficult to+identify can be uniquely identified knowing only 11 locations [Fig. 2C].+For the purpose of re-identification, more sophisticated+approaches could collect points that are more likely to reduce the+uncertainty, exploit irregularities in an individual’s behaviour, or+implicitly take into account information such as home and work-+place or travels abroad+29,33. Such approaches are likely to reduce the+number of locations required to identify an individual, vis-a`-vis the+average uniqueness of traces.+We showed that the uniqueness of human mobility traces is high,+thereby emphasizing the importance of the idiosyncrasy of human+movements for individual privacy. Indeed, this uniqueness means+that little outside information is needed to re-identify the trace of a+targeted individual even in a sparse, large-scale, and coarse mobility+dataset. Given the amount of information that can be inferred from+mobility data, as well as the potentially large number of simply+anonymized mobility datasets available, this is a growing concern.+We further showed that while E* vhðÞ+b, b , 2p/100. Together,+these determine the uniqueness of human mobility traces given the+traces’ resolution and the available outside information. These results+should inform future thinking in the collection, use, and protection+of mobility data. Going forward, the importance of location data will+only increase+34 and knowing the bounds of individual’s privacy will+Temporal resolution [h]+Spatial resolution [v]+1 cell+3 cells+5 cells+7 cells+9 cells+11 cells+13 cells+Temporal resolution [h]+Normalized uniqueness of tracesSpatial resolution [v]+Temporal resolution [h]+A B+Spatial resolution [v]+Normalized uniqueness of traces+CD+15+13+11+9+7+5+3+1+1 3 5 7 9 11 13 15+15+13+11+9+7+5+3+1+1 3 5 7 9 11 13 15+10 0+10 0+10 0 10 1+10 0 10 1+456789 1 0+0.06+0.10+0.14+p+β+E+1 hour+3 hours+5 hours+7 hours+9 hours+11 hours+13 hours+Uniqueness of traces0.70+Uniqueness of traces0.70+ β=0.157−0.007p+Figure 4 | Uniqueness of traces [e] when we lower the resolution of the dataset with (A)p 5 4 and (D) p 5 10 points. It is easier to attack a dataset that is+coarse on one dimension and fine along another than a medium-grained dataset along both dimensions. Given four spatio-temporal points, more than+60% of the traces are uniquely characterized in a dataset with an h 5 15-hours temporal resolution while less than 40% of the traces are uniquely+characterized in a dataset with a temporal resolution of h 5 7 hours and with clusters of v 5 7 antennas. The region covered by an antenna ranges from+0.15 km 2 in urban areas to 15 km 2 in rural areas. (B–C) When lowering the temporal or the spatial resolution of the dataset, the uniqueness of traces+decrease as a power function e 5 a 2 xb. (E) While e decreases according to a power function, its exponent b decreases linearly with the number of points+p. Accordingly, a few additional points might be all that is needed to identify an individual in a dataset with a lower resolution.+www.nature.com/ scientificreports+SCIENTIFIC REPORTS | 3 : 1376 | DOI: 10.1038/srep01376 4+be crucial in the design of both future policies and information+technologies.+Methods+The dataset. This work was performed using an anonymized mobile phone dataset+that contains call information for ,1.5 M users of a mobile phone operator.+The data collection took place from April 2006 to June 2007 in a western country.+Each time a user interacts with the mobile phone operator network by initiating or+receiving a call or a text message, the location of the connecting antenna is recorded+[Fig. 1A]. The dataset’s intrinsic spatial resolution is thus the maximal half-distance+between antennas. The dataset’s intrinsic temporal resolution is one hour [Fig. 1B].+Unicity test and the likelihood of deductive disclosure . The considered dataset+contains one trace T for each user. The traces spatio-temporal points contain the+region in which the user was and the time of the interaction. We evaluate the+uniqueness of a trace given a set I+p of p randomly chosen spatio-temporal points. A+trace is said to be to be compatible with Ip if Ip(T [Fig. 2A]. Note that this notion of+compatibility can easily be extended to noisier or richer data. A brute force+characterization is performed by extracting from the entire dataset of 1.5 M users+S(I+p), the set of users whose mobility traces T are compatible with Ip. All mobility+traces in the dataset T are successively tested for compatibility with Ip. A trace is+characterized ‘‘out of x’’, if the set of traces that are compatible with the points+contains at most x users: jS(Ip)j # x. A trace is uniquely characterized if the set+contains exactly one trace: jS(Ip)j 5 1. The uniqueness of traces is estimated as the+percentage of 2500 random traces that are unique givenp spatio-temporal points. The+p points composing Ip are taken at random among all the interactions the user had+with the service. As discussed, we do not apply any constraints regarding the choice of+Ip.+Minimum number of spatio-temporal location needed to uniquely characterize+every trace. Fig. 2B shows that .95 , e , 1 given Ip54. Fig. 2C evaluates the minimum+p needed to uniquely characterize every trace in a given set. This set contains a+random sample of 1000 heavy-users, i.e. users that used their phone at least 75 times+per month as their randomly chosen points might make their trace less unique.+Spatial aggregation. Spatial aggregation is achieved by increasing the size of the+regions in which the user is known to be during his interactions with the service. In the+case of discrete data, a bijective relation exists between antennas (known in this case as+centroids) and the region defined by the Voronoi tessellation. The tessellation is+defined so that every point in a region is closer to the region’s antenna than to any+other antenna. In order to increase the region’s area, one should group antennas into+clusters of a given sizev. While the problem of optimally grouping places in a 2D space+into groups of given sizes v is non trivial, it can be approximated through clustering+methods. The canonical clustering methods focus on minimizing the within-cluster+sum of squares rather than producing balanced clusters. This drawback can be+controlled by the use of a Frequency Sensitive Competitive Learning scheme+35. Fig. S2+shows the resulting group size histogram optimized for clusters of size 4. Once+antennas are aggregated into groups, their associated regions are merged.+1. Clippinger, J. In Rules for Growth: Promoting Innovation and Growth Through+Legal Reform (Kauffman Foundation, Kansas City, 2010).+2. Clanchy, M. T. From Memory to Written Records England 1066–1307 (Harvard+University Press, Cambridge, 1979).+3. Warren, S. & Brandeis, L. The right to privacy. Harvard Law Review 193, 193–220+(1890).+4. Hey, T., Tansley, S. & Tolle, K. (eds) The Fourth Paradigm: Data-Intensive+Scientific Discovery (Microsoft Research, Redmond, 2009).+5. Barabasi, A.-L. The origin of bursts and heavy tails in human dynamics. Nature+435, 207–211 (2005).+6. Clauset, A. & Eagle, N. Persistence and periodicity in a dynamic proximity+network. Proc. DIMACS (2007).+7. Eagle, N., Macy, M. & Claxton, R. Network diversity and economic development.+Science 328, 1029–1031 (2010).+8. Eagle, N., Pentland, A. & Lazer, D. Inferring social network structure using mobile+phone data. Proc. Natl. Acad. Sci. U.S.A. 106, 15274–15278 (2009).+9. Eagle, N., de Montjoye, Y.-A. & Bettencourt, L. Community computing:+Comparisons between rural and urban societies using mobile phone data.+Computational Science and Engineering 4, 144–150 (2009).+10. Reader, T. et al. Predictors of short-term decay of cell phone contacts in a large+scale communication network. Social Networks 33, 245–257 (2011).+11. Hidalgo, C. & Rodriguez, C. The dynamics of a mobile phone network. Physica A+387, 3017–3024 (2008).+12. Newman, M. E. J.Networks: An Introduction (Oxford University Press, New York,+2010).+13. Onnela, J.-P. et al. Structure and tie strengths in mobile communication networks.+Proc. Natl. Acad. Sci. U.S.A. 104, 7332–7336 (2007).+14. Szell, M., Lambiotte, R. & Thurner, S. Multirelational organization of large-scale+social networks in an online world.Proc. Natl. Acad. Sci. U.S.A. 107, 13636–13641+(2010).+15. Meloni, S. et al. Modeling human mobility responses to the large-scale spreading+of infectious diseases. Sci. Rep. 1, 62 (2011).+16. Balcan, D. et al. Multiscale mobility networks and the spatial spreading of+infectious diseases. Proc. Natl. Acad. Sci. U.S.A. 106, 21484–21489 (2009).+17. Gonzalez, M., Hidalgo, C. & Barabasi, A. Understanding individual human+mobility patterns. Nature 453, 779–782 (2008).+18. Song, C., Qu, Z., Blumm, N. & Barabasi, A. Limits of predictability in human+mobility. Science 327, 1018–1021 (2010).+19. Finding places on the go has never been easier. http://blog.foursquare.com/2012/+02/08/finding-places-on-the-go-has-never-been-easier-%E2%80%93-check-out-+the-new-explore-for-your-phone/, Accessed 2012 Jul. 1.+20. Blumberg, A. & Eckersley, P. On locational privacy and how to avoid losing it+forever. E.F.F. (2009).+21. Apple privacy policy, http://www.apple.com/legal/privacy/, Accessed 2011 Jul. 25.+22. Federal reserve financial services federal reserve study shows more than three-+quarters of non-cash payments are now electronic. Federal Reserve (2010).+23. Skyhook wireless spotRank overview, Available: http://+www.skyhookwireless.com/location-intelligence/, Accessed 2012 Jul. 17.+24. Apples app store downloads top 25 billion, http://www.apple.com/pr/library/+2012/03/05Apples-App-Store-Downloads-Top-25-Billion.html, Accessed 2012+Mar. 28.+25. The app genome project. http://blog.myLookout.com/, Accessed 2011 Jul. 27.+26. Mobile geo-location advertising will be a big number in 2015. http://adfonic.com/+wp-content/uploads/2012/03/geo-location-white-paper.pdf, Accessed 2012 Jul.+17.+27. Sweeney, L. k-anonymity: a model for protecting privacy. Int. J. Uncertainty+Fuzziness and Knowledge-Based Systems 10, 557–570 (2002).+28. Zang, H. & Bolot, J. Anonymization of location data does not work: A large-scale+measurement study. Proc. Int. Conf. on Mobile computing and networking 17,+145–156 (2011).+29. Narayanan, A. & Shmatikov, V. Robust de-anonymization of large sparse datasets.+IEEE Trans. Secur. Priv. 8, 111–125 (2008).+30. Locard, E. Traite´ de criminalistique. (J. Desvigne et ses fils Lyon, 1931).+31. Boom! Foursquare crosses 2 million users. http://techcrunch.com/2010/07/10/+foursquare-crosses-2-million-users/, Accessed 2010 Aug. 25.+32. Bates, D. & Watts, D. Nonlinear Regression Analysis and Its Applications (Wiley,+Hoboken, 1988).+33. Golle, P. & Partridge, K. On the anonymity of home/work location pairs.Pervasive+Computing 390–397 (2009).+34. Manyika, J. et al. Big data: The next frontier for innovation, competition and+productivity. McKinsey Global Institute (2011).+35. Grossberg, S. Adaptive pattern classification and universal recoding: I. Parallel+development and coding of neural feature detectors. Biol. Cybern. 23, 121–134+(1976).+Acknowledgements+We thank Damien François, Janos Kertesz, Renaud Lambiotte, Vincent Traag and Paul Van+Dooren for discussions and comments on the manuscript as well as Maxime Melchior for+sharing computer code and Susie Fu for help with the figures. This work was supported by a+grant 09/14-017 ‘‘Action de Recherche Concerte´’’ of the ‘‘Communaute´ française de+Belgique’’ on Information Retrieval in Time Evolving Networks.+Author contributions+Y.-A. de M. designed and performed experiments, analyzed data and wrote the paper;+C.A.H. designed experiments, developed analytic tools and wrote the paper; M.V. and+V.D.B. designed experiments and wrote the paper.+Additional information+Supplementary information accompanies this paper at http://www.nature.com/+scientificreports+Competing financial interests: The authors declare no competing financial interests.+License: This work is licensed under a Creative Commons+Attribution-NonCommercial-NoDerivs 3.0 Unported License. To view a copy of this+license, visit http://creativecommons.org/licenses/by-nc-nd/3.0/+How to cite this article: de Montjoye, Y.-A., Hidalgo, C.A., Verleysen, M. & Blondel, V.D.+Unique in the Crowd: The privacy bounds of human mobility. Sci. Rep. 3, 1376;+DOI:10.1038/srep01376 (2013).+www.nature.com/ scientificreports+SCIENTIFIC REPORTS | 3 : 1376 | DOI: 10.1038/srep01376 5
Diffs are computed deterministically from extracted bill text and show additions, deletions, and section moves. Scanned-PDF text extracted via OCR is flagged where confidence is low; see methodology.