Alaska businesses would let residents access and limit personal data

Covered controllers would have to respond to residents’ requests about their personal data. The rules cover businesses operating in Alaska or targeting Alaska residents that handled data for at least 35,000 consumers in the prior calendar year, or at least 10,000 consumers and earned more than 20 percent of gross revenue from selling personal data. Listed government bodies and public institutions are excluded. A controller may deny a request if it cannot reasonably link the request to the person’s data or doing so would be unreasonably burdensome. Responses are free once per consumer in each 12-month period; a controller may charge for or deny a request it shows is unfounded, excessive, or repetitive. Parents, guardians, and authorized agents may act for a consumer under the stated rules. If enacted, the act would take effect January 1, 2027, and would apply to contracts entered into on or after that date.

Covered controllers and processors would have to follow rules for collecting, using, and protecting personal data. These rules apply to controllers and processors covered by the act. Sensitive data includes health, biometric, genetic, precise location, and certain identity information. Sensitive data could be collected or used only when strictly needed for a service the consumer requested, could not be sold, and generally could be transferred only with the consumer’s clear consent. A controller that knows or reasonably should know a consumer is under 18 could not use that minor’s data for targeted ads or sell it. The bill lists exceptions, including for legal duties, requested services, security, and certain research. If enacted, the act would take effect January 1, 2027. Required assessments of certain high-risk data uses would not begin until January 1, 2028.

A data broker would have to register with the state before operating as a broker. A data broker is a controller that knowingly collects and sells a consumer’s personal data to third parties without a direct relationship with that consumer. Consumer reporting agencies covered by federal credit reporting law are excluded to that extent. A broker would provide contact and website details, including its page for consumer opt-outs, and pay a fee set by regulation. The Department of Commerce, Community, and Economic Development would publish a registry. Fees and certain penalties would go to a consumer privacy account, and spending from that account would depend on legislative approval. If enacted, registration would begin when the act takes effect on January 1, 2027.