HB827: HB827 Menstrual Data Privacy and Protection Act; enact

25 LC 59 0137 House Bill 827 By: Representatives McQueen of the 61st, Roberts of the 52nd, Miller of the 62nd, Evans of the 57th, Willis of the 55th, and others A BILL TO BE ENTITLED AN ACT To amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling1 and other trade practices, so as to enact the "Menstrual Data Privacy and Protection Act"; to2 provide for definitions; to require explicit consent; to provide for security, notification of data3 breaches, and deletion of data; to provide for violations; to provide for reporting; to provide4 for relief; to provide for related matters; to provide for legi slative purpose; to repeal5 conflicting laws; and for other purposes.6 BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:7 SECTION 1.8 This Act shall be known and may be cited as the "Menstrual Data Privacy and Protection9 Act."10 SECTION 2.11 The purpose of this Act is to safeguard the privacy and securit y of menstrual and12 reproductive health data collected by applications, devices, pharmacies, healthcare providers,13 and other entities. This legislation ensures that individuals retain control over their sensitive14 H. B. 827 - 1 - 25 LC 59 0137 personal information and protects against misuse, unauthorized sharing, and data breaches15 involving such information.16 SECTION 3.17 Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other18 trade practices, is amended by enacting a new article to read as follows:19 "ARTICLE 3720 10-1-960.21 As used in this article, the term:22 (1) 'Entity' means any organization, business, or individual c ollecting menstrual data,23 including, but not limited to, digital applications and platfor ms, pharmacies and retail24 establishments, healthcare providers, clinics, and hospitals.25 (2) 'Explicit consent' means a clear and affirmative agreement provided by an individual26 after being fully informed of the specific purpose for menstrual data collection and usage.27 (3) 'Menstrual data' means any information related to an indiv idual's menstrual cycle,28 reproductive health, or related bodily functions collected by an entity, including, but not29 limited to, menstrual tracking applications and devices, pharma cies and healthcare30 providers, and online or in-person retail purchases of menstrual products.31 10-1-961.32 (a) An entity shall obtain explicit consent from an individual before collecting, processing,33 or sharing menstrual data belonging to such individual.34 (b) Menstrual data may only be used by an entity for specific purposes provided in an35 explicit consent agreement. No entity shall use such menstrual data for unrelated purposes,36 H. B. 827 - 2 - 25 LC 59 0137 including marketing or targeted advertising, without obtaining explicit consent to such37 effect.38 (c) No entity shall sell menstrual data or reproductive health data to third parties under any39 circumstances.40 (d) Each instance of an entity collecting, processing, or sharing the menstrual data of an41 individual without obtaining such individual's explicit consent , using an individual's42 menstrual data for purposes not provided in an explicit consent agreement with such43 individual, or selling menstrual data belonging to an individual shall constitute a separate44 violation.45 10-1-962.46 (a) An entity shall implement industry standard security measu res, including, but not47 limited to, data encryption during storage and transmission, re gular security audits, and48 vulnerability assessments.49 (b) An entity shall notify affected individuals and the Attorney General within 72 hours50 of any data breach involving menstrual data.51 (c) Every individual shall have the right to request that any entity in possession of52 menstrual data belonging to such individual delete such menstru al data at any time. An53 entity shall comply with menstrual data deletion requests withi n 30 days and notify the54 requesting individual when the data at issue has been deleted. Deleted menstrual data shall55 not be retained in any form by the entity or its partners.56 (d) Each instance of an entity failing to implement the securi ty measures provided in57 subsection (a) of this Code section, to notify an individual af fected by a data breach58 involving such individual's menstrual data as provided in subse ction (b) of this Code59 section, or to delete menstrual data following the procedures provided in subsection (c) of60 this Code section shall constitute a separate violation.61 H. B. 827 - 3 - 25 LC 59 0137 10-1-963.62 (a) Each entity shall publish on a website accessible to the public a privacy policy detailing63 the types of menstrual data it collects, the purposes for which such data is used, and any64 third parties with whom such data may be shared.65 (b) Each entity shall publish on a website accessible to the p ublic an annual report66 summarizing data protection measures it has implemented, any data breaches or incidents67 it has reported during the year, and any efforts it has made to comply with the provisions68 of this article.69 10-1-964.70 (a) Whenever it may appear to the Attorney General that an ent ity has violated the71 provisions of this article, the Attorney General may seek, and any superior court of72 competent jurisdiction may grant, any or all of the following relief:73 (1) A temporary restraining order or temporary or permanent injunction;74 (2) A civil penalty of up to $50,000.00 per violation or $500.00 per affected individual,75 whichever is greater;76 (3) A declaratory judgment; or77 (4) Other relief as the court deems just and equitable, includ ing, but not limited to,78 reasonable attorney's fees and costs.79 (b) Any individual whose menstrual data is collected, processe d, shared, or sold in80 violation of the provisions of this article may bring a civil action against the violating entity81 in any court having jurisdiction over such entity seeking any or all of the following relief:82 (1) Actual damages;83 (2) Statutory damages of up to $2,500 per violation; or84 (3) Reasonable attorney's fees and costs."85 H. B. 827 - 4 - 25 LC 59 0137 SECTION 4.86 All laws and parts of laws in conflict with this Act are repealed.87 H. B. 827 - 5 -