Amends TCA Title 47, Chapter 18.

CONTROLLER REGISTRY This bill requires a natural or legal person that, alone or jointly with others, determines the purpose and means of processing personal information ("controller"), on or before January 31 following a year in which this bill applies to a controller, to register with the consumer protection division of the office of the attorney general and reporter ("division"). In registering with the division, a controller must pay a registration fee in an amount determined by the division, not to exceed the division's reasonable costs of establishing, maintaining, and providing a webpage on the division's website that contains the accessible deletion mechanism described below. The fee collected must be deposited into the Information Protection Registry fund, described under the heading "Information Protection Registry Fund," below. WEBPAGE AND ACCESSIBLE DELETION MECHANISM This bill requires the division to create, by July 1, 2025, the following: (1) A webpage that has the accessible deletion mechanism in a conspicuous location, and provides information about: (i) how a consumer can utilize the accessible deletion mechanism, including the process for submitting a deletion request and examples of the types of information that may be deleted; and (ii) the additional rights a consumer may have under this bill; and (2) An accessible deletion mechanism that does the following: (A) Implements and maintains reasonable security procedures and practices, including administrative, physical, and technical safeguards appropriate to the nature of the information and the purposes for which the personal information will be used; (B) Protects consumers' personal information from unauthorized use, disclosure, access, destruction, or modification; and (C) Allows a consumer or the consumer's authorized agent to do the following: (i) through a single authenticated consumer request, request that every controller to which this bill applies and that maintains personal information about the consumer delete the personal information related to the consumer that is held by the controller, or an agent of the controller; (ii) selectively exclude a specific controller from a request; (iii) make a request to alter a previous request after at least 45 days have passed since the consumer last made such a request; and (iv) verify the status of a deletion request submitted by the consumer. ACCESSIBLE DELETION MECHANISM REQUIREMENTS This bill requires the accessible deletion mechanism to, at a minimum, do the following: (i) allow a controller registered with the division to determine whether a consumer has submitted an authenticated request to delete the personal information related to the consumer; (ii) be available for use by a consumer at no cost to the consumer; and (iii) be usable by a consumer with a disability. CONTROLLER ACCESS REQUIREMENTS This bill requires a controller to access the accessible deletion mechanism required under this bill at least once every 45 days and do the following: (1) Within 45 days after receipt of a deletion request, process the deletion request and delete all required personal information related to the consumer who made the request; (2) Process the request as an opt-out of the sale or sharing of the consumer's personal information, consistent with the consumer right described under state law, if the controller denies a consumer's deletion request because the controller is unable to authenticate the request using commercially reasonable efforts; and (3) Direct any affiliates of the controller to: (i) delete all personal information in the affiliate's possession related to the consumer who submitted the deletion request; or (ii) process a request as an opt-out of the sale or sharing of the consumer's personal information, consistent with the consumer right described under state law. This bill does not require a controller, or its affiliate, to delete a consumer's personal information if such deletion would not be required if the request was submitted to the controller in accordance with state law. INFORMATION PROTECTION REGISTRY FUND This bill creates within the state general fund a special account to be known as the Information Protection Registry Fund ("fund"). This bill requires that the registration fee collected from a controller pursuant to this bill be deposited into the fund and used only to implement and administer the purposes set forth in this bill. In addition to appropriations made to the fund, the division may accept other funds, public or private, by way of gift or grant to the fund. Any such gift or grant must be deposited into the fund to be expended in accordance with this bill. This bill requires the division to administer the fund, and moneys in the fund must be expended and obligated only in accordance with this bill and in accordance with appropriations made by the general assembly. All expenditures from the fund are subject to review in the form of an annual report submitted by the division to the commissioner of finance and administration no later than January 1, 2026, and by January 1 each year thereafter.