A bill

 

TO AMEND THE SOUTH CAROLINA CODE OF LAWS BY ENACTING THE "DIGITAL CHOICE ACT" BY ADDING CHAPTER 31 TO TITLE 37 SO AS TO DEFINE NECESSARY TERMS; TO ESTABLISH LEGISLATIVE FINDINGS ABOUT SOCIAL MEDIA DATA CONTROL AND COMPETITION; TO ESTABLISH THE FORMAT IN WHICH A SOCIAL MEDIA SERVICE MUST PROVIDE A CONSUMER WITH A COPY OF THE CONSUMER'S PERSONAL DATA UPON REQUEST; TO REQUIRE A SOCIAL MEDIA COMPANY TO IMPLEMENT DATA INTEROPERABILITY INTERFACES; TO ESTABLISH REQUIREMENTS FOR DATA SHARING BETWEEN SOCIAL MEDIA SERVICES; TO PROVIDE CIVIL PENALTIES FOR VIOLATIONS OF THIS CHAPTER; AND TO PROVIDE CONSUMERS WITH CERTAIN RIGHTS.

 

Be it enacted by the General Assembly of the State of South Carolina:

 

SECTION 1.  Title 37 of the S.C. Code is amended by adding:

 

CHAPTER 31

 

Digital Choice Act

 

    Section 37-31-10.  As used in this chapter:

    (1) "Administrator" means the officer appointed by the Commission on Consumer Affairs to administer this title.

    (2) "Controller" means a person doing business in the State who determines the purposes for which and the means by which personal data is processed, regardless of whether the person makes the determination alone or with others.

    (3) "Department" means the Department of Consumer Affairs.

    (4) "Open protocol" means a publicly available technical standard that:

       (a) enables interoperability and data exchange between social media services by providing a common data infrastructure where multiple social media services can access, contribute to, and synchronize a user's personal data;

       (b) is free from:

           (i) licensing fees; and

           (ii) patent restrictions; and

       (c) governs how social media services communicate and exchange data with each other.

    (5)(a) "Personal data" means information that is linked or reasonably linkable to an identified individual or an identifiable individual. "Personal data" includes a user's social graph.

       (b) "Personal data" does not include deidentified data, aggregated data, or publicly available information.

    (6)(a) "Social graph" means data that represents a person's connections and interactions within a social media service.

       (b) "Social graph" includes:

           (i) the person's social connections with other users;

           (ii) content created by the person;

           (iii) the person's responses to other users' content, including comments, reactions, and shares;

           (iv) other users' responses to the person's content; and

           (v) metadata associated with any of the items described above.

       (c) "Social graph" does not include another user's or an entity's content and responses that have been designated private by those users and entities, including private messages.

    (7) "Social media company" means an entity that owns or operates a social media service.

    (8)(a) "Social media service" means a public website or application that:

           (i) displays content that is primarily generated by account holders and not by the social media company;

           (ii) permits an individual to register as an account holder and create a profile that is made visible to the general public or a set of other users defined by the account holder;

           (iii) connects account holders to allow users to interact socially with each other within the website or application; and

           (iv) allows account holders to post content viewable by other users.

       (b) "Social media service" does not include:

           (i) email;

           (ii) cloud storage; or

           (iii) document viewing, sharing, or collaboration services.

    (9) "User" means an individual located in the State who accesses or uses a social media service.

 

    Section 37-31-20.  The General Assembly finds that:

    (1) an individual has a right to control and move the individual's own personal data, including social interactions online;

    (2) companies have demonstrated a pattern of restricting the interoperability of content, preventing users from easily sharing posts and interactions across different platforms; and

    (3) the State should ensure that individuals have the right to access a complete personal data record from social media platforms.

 

    Section 37-31-30.  If a consumer requests a copy of the consumer's personal data pursuant to Section 37-31-70, a social media service shall provide the personal data, including the user's social graph, in a format that:

    (1) is portable, to the extent technically feasible;

    (2) is readily usable, to the extent practicable; and

    (3) allows the consumer to transmit the data to another controller without impediment if the controller processes the data by automated means.

 

    Section 37-31-40.  (A) A social media company shall implement a transparent, third-party-accessible interoperability interface or interfaces to allow users to choose to:

       (1) share a common set of the user's personal data between the social media services designated by the user; and

       (2) enable third parties to access content created by the user and to be notified when new or updated content is available, with the user's permission.

    (B) A social media company shall reasonably secure all personal data obtained through an interoperability interface.

    (C) To achieve interoperability under subsection (A), a social media company shall:

       (1) utilize an open protocol;

       (2) facilitate and maintain interoperability and synchronous data sharing with other social media services through an interoperability interface, based on reasonable terms that do not discriminate between social media services;

       (3) establish reasonable and proportionate thresholds related to the frequency, nature, and volume of requests, beyond which the social media company may assess a reasonable fee for such access;

       (4) offer to other social media companies a functionally equivalent version of any internal interfaces created by the social media company for the social media company's own social media services; and

       (5) disclose to other social media companies complete, accurate, and regularly updated documentation describing access to the interoperability interface required under this section.

    (D) A social media company or third party shall safeguard the privacy and security of a user's personal data obtained from other social media services through the interoperability interface in accordance with the social media company's or third party's privacy notice and administrative, technical, and physical data security practices.

    (E) A social media company or third party may not share or receive a user's personal data through the interoperability interface except with the user's consent.

    (F) A social media company shall adopt an accessible, prominent, and persistent method for users to give consent for data sharing with other social media services or third parties through the interoperability interface.

    (G) A social media company is not required to:

       (1) provide access to:

           (a) inferences, analyses, or derived data that the social media company has generated internally about a user; or

           (b) proprietary algorithms, ranking systems, or other internal operating mechanisms; or

       (2) transmit personal data that:

           (a) is stored or structured in a proprietary format; and

           (b) meets both of the following criteria:

               (i) no open, industry-standard format is reasonably available; and

               (ii) transmitting the data would disclose information described in item (1) of this subsection.

    (H) This chapter does not apply to an entity that is:

       (1) owned, controlled, operated, or maintained by a religious organization; and

       (2) exempt from property taxation under state law.

 

    Section 37-31-50.  (A) The department may identify open protocols that the department has determined, after an assessment, meet the requirements of Section 37-31-40.

    (B) If a social media company uses an open protocol that the department identifies under subsection (4), the social media company shall be entitled to a rebuttable presumption of providing access on reasonable terms that do not discriminate between social media   services.

 

    Section 37-31-60.  (A) The department shall administer and enforce this chapter.

    (B) The Attorney General, upon request, shall give legal advice to, and act as counsel for, the department in the exercise of the department's responsibilities under this chapter.

    (C)(1) In addition to the department's enforcement powers under Chapter 6 or any other provisions of this title:

           (a) the department director may impose an administrative fine of up to two thousand five hundred dollars for each violation of this chapter; and

           (b) the department may bring an action in court to enforce a provision of this chapter.

       (2) In a court action by the department to enforce a provision of this chapter, the court may:

           (a) declare that the act or practice violates a provision of this chapter;

           (b) enjoin actions that violate this chapter;

           (c) order disgorgement of any money received in violation of this chapter;

           (d) order payment of disgorged money to an injured purchaser or consumer;

           (e) impose a civil penalty of up to two thousand five hundred dollars for each violation of this chapter;

           (f) award actual damages to an injured purchaser or consumer; and

           (g) award any other relief that the court deems reasonable and necessary.

       (3) If a court grants judgment or injunctive relief to the department, the court shall award the department:

           (a) reasonable attorney's fees;

           (b) court costs; and

           (c) investigative fees.

       (4)(a) A person who violates an administrative or court order issued for a violation of this chapter is subject to a civil penalty of not more than five thousand dollars for each violation.

           (b) A civil penalty authorized under this section may be imposed in any civil action brought by the department, or by the Attorney General on behalf of the department.

 

    Section 37-31-70.  (A) A consumer has the right to:

       (1) confirm whether a controller is processing the consumer's personal data; and

       (2) access the consumer's personal data.

    (B) A consumer has the right to delete the consumer's personal data that the consumer provided to the controller.

    (C) A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:

       (1) to the extent feasible, is portable;

       (2) to the extent practicable, is readily usable; and

       (3) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

    (D) A consumer has the right to request that a controller correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data.

    (E) A consumer has the right to opt out of the processing of the consumer's personal data for purposes of:

       (1) targeted advertising; or

       (2) the sale of personal data.

 

SECTION 2.  This act takes effect upon approval by the Governor.

----XX----