A bill

 

TO AMEND THE SOUTH CAROLINA CODE OF LAWS SO AS TO ENACT THE "CHATBOT PROTECTION ACT"; AND BY ADDING CHAPTER 80 TO TITLE 39 SO AS TO PROVIDE RESTRICTIONS ON CERTAIN CHATBOT ACTIVITies AND TO PROVIDE FOR CIVIL REMEDIES.

 

Be it enacted by the General Assembly of the State of South Carolina:

 

SECTION 1.  This act may be cited as the "Chatbot Protection Act."

 

SECTION 2.  Title 39 of the S.C. Code is amended by adding:

 

CHAPTER 80

 

Chatbot Protection

 

    Section 39-80-10.  As used in this chapter:

       (1)(a) "Advertisement" means any written or oral statement, illustration, or depiction that is displayed in exchange for monetary or other valuable consideration if the written or oral statement, illustration, or depiction:

               (i) promotes the sale or use of a good or service; or

               (ii) is designed to increase interest in a brand, good, or service.

           (b) "Advertisement" includes access to data between the chatbot provider and a brand, good, or service.

       (2)(a) "Affirmative consent" means a clear affirmative act that signifies a user's freely given information and unambiguous authorization for an act or practice in response to a specific request from a chatbot provider, if:

               (i) The request is provided to the user in a clear and conspicuous stand-alone disclosure.

               (ii) The request includes a description that is written in easily understandable language.

               (iii) The request is made in a manner that is reasonably accessible and available by users with disabilities.

               (iv) The request is made available to the user in each language in which the chatbot provider provides a chatbot.

               (v) The option to decline consent is at least as prominent as the option to give consent, and the option to decline consent takes the same or fewer number of steps as the option to give consent.

               (vi) Affirmative consent to an act or practice may not be inferred from the inaction of the user or the user's continued use of a chatbot.

           (b) "Affirmative consent" does not include:

               (i) acceptance given by general or broad terms of use;

               (ii) hovering over, muting, pausing, or closing a given piece of content;

               (iii) an agreement that is obtained through the use of a false, fraudulent, or materially misleading statement or representation; or

               (iv) an agreement that is obtained through the use of other dark patterns.

       (3) "Chatbot" means an algorithmic or automated system that generates information through text, audio, image, or video in a manner that simulates interpersonal interactions or conversations including artificial intelligence.

       (4) "Chatbot provider" means any person that creates, distributes, or otherwise makes a chatbot available to a user.

       (5) "Chat log" means:

           (a) input data or a record of the input data; and

           (b) output data that is generated by a chatbot or from interactions with a chatbot.

       (6) "Dark pattern" means a user interface that is designed or manipulated to subvert or impair a user's autonomy, decision making, or choice.

       (7) "Deidentified data" means information that:

           (a) cannot reasonably be used to infer or derive the identity of a user;

           (b) does not identify a user; and

           (c) is not linked or is not reasonably linkable to a user.

       (8) "Input data" means information including texts, photos, audio files, video files, and any type of file that is provided to a chatbot by a user.

       (9) "Model" means an engineered or machine-based system underlying a chatbot that is based on the input data that it receives and that can infer how to generate output data that can influence physical or virtual environments.

       (10)(a) "Personal data" means:

               (i) any information, including derived data, that is linked or is reasonably linkable either by itself or in combination with other information to an identified or identifiable user; or

               (ii) a device that identifies or is linked or is reasonably linkable to a user.

           (b) "Personal data" does not include deidentified data or publicly available information.

       (11)(a) "Publicly available information" means information that has been lawfully made available to the public subject to a public records request.

           (b) "Publicly available information" does not include:

               (i) obscene items;

               (ii) biometric data;

               (iii) personal data that is created through the combination of personal data and publicly available information;

               (iv) genetic data, unless the genetic data was made available to the public by the user to whom the genetic data pertains;

               (v) information that is made available to the public by a user who uses a website or online platform on which the user has restricted the information to a specific audience; or

               (vi) intimate images that are either authentic or computer generated and that are known to be nonconsensual.

       (12) "Process" or "processing" means any operation or set of operations that are performed on personal data or input data including the use, storage, disclosure, analysis, deletion, or modification of personal data or input data.

       (13)(a) "Profiling" means to process personal data or input data to classify or designate personality traits and behavioral characteristics of a user.

           (b) "Profiling" does not include processing chat logs for user safety or to otherwise comply with this chapter.

       (14)(a) "Sell" means:

               (i) the exchange of personal data or input data for monetary or other valuable consideration; or

               (ii) to make personal data or input data available to a third party for monetary or other valuable consideration.

           (b) "Sell" does not include:

               (i) the disclosure of personal data or input data to a third party that processes the personal data or input data on behalf of the chatbot provider;

               (ii) the disclosure of personal data or input data where the user provides affirmative consent and directs the chatbot provider to disclose the personal data or input data or intentionally uses the chatbot provider to interact with a third party; or

               (iii) the disclosure of personal data or input data that the user intentionally made available to the public through social media and did not restrict the information to a specific audience.

       (15)(a) "Training" means the use of input data to adjust or modify a model.

           (b) "Training" does not include:

               (i) tests that are used to identify risk of harm to users;

               (ii) adjustments or modifications that are made to address identified risk of harm to users; or

               (iii) any action that is necessary to comply with this article or as otherwise required by law.

       (16) "User" means any natural person regardless of age.

 

    Section 39-80-20.  (A) A chatbot provider may not:

       (1) process personal data to inform a chatbot output unless processing personal data is necessary to fulfill an express request that is made by a user and the user provides affirmative consent;

       (2) process a user's chat log:

           (a) to determine whether to display an advertisement for a product or service to a user;

           (b) to determine a product or service or category of a product or service to advertise to a user; or

           (c) to customize an advertisement for presentation to a user;

       (3) process a user's chat log and personal data:

           (a) if the chatbot provider knows or reasonably should have known that based on knowledge of objective circumstances the user is a minor and the user's parent or legal guardian did not provide affirmative consent;

           (b) for training purposes if the chatbot provider knows or reasonably should have known that based on knowledge of objective circumstances the user is a minor and the user's parent or legal guardian did not provide affirmative consent;

           (c) for training purposes if the user is an adult, unless the chatbot provider first obtains affirmative consent; or

           (d) to engage in profiling beyond what is necessary to fulfill an express request;

       (4) profile a user based on any classification or designation of the user's personality or behavioral characteristic beyond what is necessary to fulfill an express request made by the user;

       (5) sell a user's chat logs;

       (6) retain a user's chat log for more than ten years, unless retention is necessary to comply with this chapter or otherwise required by law;

       (7) discriminate or retaliate against a user, including:

           (a) denying products or services to the user;

           (b) charging different prices or rates for products or services to the user; or

           (c) providing lower quality products or services to the user for refusing to consent to the use of chat logs or personal data for training purposes.

    (B) A user has a right to access the user's own chat logs at any time. A chatbot provider shall provide a user's own chat log on request by the user and shall provide the chat log in a downloadable and easy to read format. A chatbot provider may not discriminate or retaliate against a user that requests the user's chat.

    (C) A governmental entity may not compel the production of or access to input data or chat logs from a chatbot provider, except as pursuant to a wiretap warrant.

    (D) A chatbot provider shall develop, implement, and maintain a comprehensive data security program that contains administrative, technical, and physical safeguards that are proportionate to the volume and nature of personal data and chat logs that are maintained by the chatbot provider.  The program must be written and made publicly available on the chatbot provider's website.

    (E) A chatbot provider shall take the necessary physical, administrative, and technical measures to prevent deidentified data from being reidentified and to process, retain, and transfer deidentified data without any reasonable means of reidentification.

 

    Section 39-80-30.  (A) A chatbot provider may not:

       (1) use any term, letter, or phrase in the advertising, interface, or output data of a chatbot that states or implies that the advertising, interface, or output data of a chatbot is endorsed by or equivalent to any of the following:

           (a) any certified, registered, or licensed professional;

           (b) a licensed legal professional;

           (c) a certified public accountant;

           (d) an investment advisor or an investment advisor representative; or

           (e) a licensed fiduciary;

       (2) include any representation in the advertising, interface, or output data of a chatbot that states or implies the user's input data or chat log is confidential.

    (B) A chatbot provider shall provide clear, conspicuous, and explicit notice to a user that the user is interacting with a chatbot rather than a natural person before the chatbot may generate any output data. The chatbot provider shall include this notice at the beginning of each chatbot communication with a user every hour thereafter and each time a user asks whether the chatbot is a natural person. The text of the notice must:

       (1) be written in the same language that the chatbot communicates with the user and must appear in a font size that is easily readable by an average user and is not smaller than the largest font size used for other chatbot communications; and

       (2) must comply with the rules adopted and the regulations promulgated by the Attorney General pursuant to Section 39-80-40.

    (C) In compliance with the rules adopted and the regulations promulgated by the Attorney General pursuant to Section 39-80-40, a chatbot provider shall:

       (1) on a monthly basis:

           (a) evaluate its chatbot for potential risk of harm to users; and

           (b) make information about its chatbot publicly available on its website; and

       (2) mitigate any risk of harm to users.

 

    Section 39-80-40.  (A) The Attorney General shall adopt rules and promulgate regulations to implement this chapter. The rules and regulations must:

       (1) describe the form and content of the notice that is required pursuant to Section 39-80-30;

       (2) provide an example template for the notice that is required pursuant to Section 39-80-30;

       (3) describe any potential risk of harm to users; and

       (4) provide requirements for a chatbot provider to implement to reduce the risk of harm to users.

    (B) The Attorney General may adopt any other rules or promulgate regulations necessary to implement this chapter.

 

    Section 39-80-50.  (A) A chatbot is considered a product for the purposes of a product liability action.

    (B) A chatbot provider has a duty to ensure that the use of the chatbot provider does not cause injury to a user.

    (C) A chatbot provider is liable for any injury that the chatbot causes to a user if:

       (1) the chatbot provider exercised all reasonable care in the design and distribution of the chatbot; or

       (2) the chatbot provider did not directly distribute the chatbot to the user or otherwise enter into a contractual relationship with the user.

 

    Section 39-80-60.  (A) The Attorney General or a county attorney may bring a civil action against a chatbot provider that violates this chapter and that includes any of the following:

       (1) enjoining an act or practice in violation of this chapter;

       (2) enforcing compliance with this chapter or a rule adopted or regulation promulgated pursuant to this chapter;

       (3) obtaining damages, civil penalties, restitution, or other remedies; or

       (4) obtaining reasonable attorney's fees and other litigation costs.

    (B) A violation of Section 39-80-20 or 39-80-30 constitutes an injury in fact to a user.

    (C) A user who is injured by a violation of Section 39-80-20 or 39-80-30 may bring a civil action against the chatbot provider, and a court of competent jurisdiction may award a prevailing plaintiff any of the following:

       (1) a civil penalty of not more than five thousand dollars per violation of this chapter;

       (2) punitive damages for reckless and knowing conduct;

       (3) injunctive relief;

       (4) declaratory relief; or

       (5) reasonable attorney's fees and litigation costs.

 

SECTION 3.  This act takes effect upon approval by the Governor.

----XX----