SB166,4,2 (g) “Consumer” means an individual who is a resident of this state acting only in an individual or household context. “Consumer” does not include an individual acting in a commercial or employment context.

SB166,4,4 (h) “Controller” means a person that, alone or jointly with others, determines the purpose and means of processing personal data.

SB166,4,5 (i) “Covered entity” has the meaning given in 45 CFR 160.103.

SB166,4,7 (ja) “Cures Act” means the federal 21st Century Cures Act and valid federal regulations enacted pursuant to such provisions.

SB166,4,10 (jd) “Dark pattern” means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice.

SB166,4,15 (jg) “Decisions that produce legal or similarly significant effects concerning a consumer” means a decision made by the controller that results in the provision or denial by the controller of financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities, such as food and water.

SB166,4,17 (ka) “Deidentified data” means data that cannot reasonably be linked to an identified or identifiable individual, or a device linked to such person.

SB166,4,20 (kb) “Identified or identifiable individual” means a person who can be readily identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier.

SB166,4,23 (La) “HIPAA” means the federal Health Insurance Portability and Accountability Act and valid federal regulations enacted pursuant to the act, including 45 CFR 164.500 to 164.534.

SB166,5,3 (Lg) “HITECH” means the federal Health Information Technology for Economic and Clinical Health Act and valid federal regulations enacted pursuant to the act.

SB166,5,4 (m) “Institution of higher education” has the meaning given in s. 39.32 (1) (a).

SB166,5,7 (n) “Nonprofit organization” means any corporation organized under ch. 181, any organization identified under s. 895.486 (2) (e), or any organization exempt from taxation under section 501 (c) (3), (6), or (12) of the Internal Revenue Code.

SB166,5,10 (o) “Personal data” means any information that is linked or reasonably linkable to an identified or identifiable individual. “Personal data” does not include deidentified data or publicly available information.

SB166,5,17 (p) “Precise geolocation data” means information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet. “Precise geolocation data” does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

SB166,5,21 (q) “Process” or “processing” means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.

SB166,5,23 (r) “Processor” means an individual or person that processes personal data on behalf of a controller.

SB166,6,4 (s) “Profiling” means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

SB166,6,9 (t) “Pseudonymous data” means personal data that cannot be attributed to a specific individual without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable individual.

SB166,6,15 (u) “Publicly available information” means information that is lawfully made available through federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

SB166,6,18 (v) “Sale of personal data” means the exchange of personal data for monetary or other valuable consideration by the controller to a 3rd party. “Sale of personal data” does not include any of the following:

SB166,6,20 1. The disclosure of personal data to a processor that processes the personal data on behalf of the controller.

SB166,6,22 2. The disclosure of personal data to a 3rd party for purposes of providing a product or service requested by the consumer.

SB166,7,2 3. The disclosure of personal data based on the consumer directing the controller to disclose the personal data or intentionally using the controller to interact with a 3rd party.

SB166,7,3 4. The disclosure or transfer of personal data to an affiliate of the controller.

SB166,7,6 5. The disclosure of information that a consumer intentionally made available to the general public via a channel of mass media and did not restrict to a specific audience.

SB166,7,9 6. The disclosure or transfer of personal data to a 3rd party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the 3rd party assumes control of all or part of the controller’s assets.

SB166,7,10 (w) “Sensitive data” includes the following:

SB166,7,12 1. Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.

SB166,7,14 2. The processing of genetic or biometric data for the purpose of uniquely identifying an individual.