House Judiciary advances consumer data privacy bill with 'duty of loyalty'

The Alaska House Judiciary Committee voted 3-2 on May 8 to advance a consumer data privacy bill that would give Alaskans new rights over how their personal information is collected and used.

House Bill 367, the Consumer Personal Information Privacy Act sponsored by Representative Andi Story, would limit collection and sharing of personal data to what is reasonably necessary to provide a requested service. The bill gives Alaskans the right to know when their data is being collected, who has access to it, and how it is being used.

Story told the committee the core intent remains the same as earlier versions: to establish a public data broker registry and enact the Alaska Data Privacy Act so that Alaskans have meaningful control over their personal data and stronger protections for their constitutional right to privacy.

The committee adopted two amendments on May 8. Amendment 1 made a technical correction, changing "and" to "or" on page 8, line 3. Amendment 2 borrowed language from recently enacted Utah law that adds what is called a "duty of loyalty" requiring companies that control consumer data to act in the best interests of consumers.

"The way this language came about in Utah was there was concern that because the technology develops so quickly and changes so much, they wanted some language in there that basically would provide protections that beyond, like, whatever the technology today might be," committee chair Andrew Gray said.

The duty of loyalty provision prohibits controllers from performing activities related to collection, processing, or transfer of personal data in ways that create disproportionate risk to individuals or are not in their best interest. Controllers are the entities that determine how data is collected and used. The provision is meant as a backstop to the bill's specific enumerated rights, addressing situations where a company might technically comply with the letter of the law but still harm consumers.

Story emphasized the bill's importance as other states adopt similar protections. "Alaskans should be able to know when personal data is being collected about them, who has access to it, and how it is being used," Story said.

The bill establishes a public data broker registry and creates the Alaska Data Privacy Act. It limits data collection and sharing to what is reasonably necessary for requested services, security, and fraud protection. Violations would be deemed unfair trade practices.

Representatives Eyeshide, Mina, and Gray voted yes. Representatives Costello and Underwood voted no.

Alaska joins a growing number of states enacting consumer privacy protections. The Legislature previously considered HB 159, a similar consumer data privacy measure, during the 2021-2022 session. That bill was advanced by the House Labor and Commerce Committee after revisions led by Representative Zack Fields and privacy advocates.