STATEMENT TO

[Fifth Reprint]

SENATE, No. 332

with Assembly Floor Amendmentss

(Proposed by Assemblyman MUKHERJI)

ADOPTED: DECEMBER 21, 2023

      These floor amendments:

      (1)  revise certain definitions within the bill;

      (2)  clarify that a controller may require a consumer to use an existing account to submit a verified request;

      (3)  remove a redundant component from the privacy notice provisions of the bill;

      (4)  remove a provision allowing a controller to charge escalated amounts for second or subsequent identical consumer requests for information;

      (5)  clarify that a controller is not required to authenticate an opt-out request;

      (6)  clarify that a consumer’s option to opt-out applies to the sale of data or targeted advertising;

      (7)  extend the deadline for controllers to comply with the provisions of the bill from four months to six months after the bill's effective date;

      (8)  modify the requirement for controllers regarding default settings, requiring a consumer's affirmative, freely given, and unambiguous choice to opt into the processing of their personal data;

      (10)  remove a redundant component from the opt-out provisions of the bill;

      (11)  add a provision, which requires a single data protection assessment;

      (12)  include an exemption for data subject to Title V of the federal “Gramm-Leach-Bliley Act,” 15 U.S.C. s.6801 et seq.; and

      (13)  make certain technical changes.