SECTION 1. Legislative findings. The general assembly finds and declares as follows:
(1) The Fourth Amendment to the United States Constitution guarantees that “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized";
(2) The United States Supreme Court has observed that “Few protections are as essential to individual liberty as the right to be free from unreasonable searches and seizures. The Framers made that right explicit in the Bill of Rights following their experience with the indignities and invasions of privacy wrought by general warrants and warrantless searches that had so alienated the colonists and had helped speed the movement for independence. Ever mindful of the Fourth Amendment and its history, the Court has viewed with disfavor practices that permit police officers unbridled discretion to rummage at will among a person’s private effects.” Byrd v. United States, 138 S. Ct. 1518, 1526 (2018). Accordingly, “As technology has enhanced the Government’s capacity to encroach upon areas normally guarded from inquisitive eyes, [the United States Supreme] Court has sought to assure preservation of that degree of privacy against government that existed when the Fourth Amendment was adopted.” Carpenter v. United States, 138 S.Ct. 2206, 2214 (2018);
(3) Law enforcement agencies are increasingly evading warrant requirements by purchasing personal data from data brokers and other data collectors – a practice that was well- described by the Project on Government Oversight as follows: “Normally, if law enforcement officers want to access your [personal] data, they need a warrant. But a glaring loophole in current law allows law enforcement and government intelligence agencies to pay third party data brokers to gain access to your private, sensitive [personal] data — no warrant needed. The government can (and often does) purchase the personal... data of American citizens from unregulated brokers who offer it up to the highest bidder, all without any court oversight. This is the equivalent of police bypassing the requirement to get a warrant to search someone’s apartment by simply handing their landlord an envelope of cash; and
(4) Law enforcement has been able to effectively and efficiently enforce our criminal laws for more than 230 years without needing to evade Fourth Amendment warrant requirements that are essential to protecting Americans’ liberty and privacy in the digital age.
SECTION 2. Title 42 of the General Laws entitled "STATE AFFAIRS AND GOVERNMENT" is hereby amended by adding thereto the following chapter: 42-28.11-1. Definitions. As used in this chapter:
(1) “Governmental entity” means an agency, instrumentality, or other entity of the state or a political subdivision thereof, including multijurisdictional agencies, instrumentalities, and entities, or any person acting on behalf thereof.
(2) “Law enforcement entity” means an agency or other instrumentality of a governmental entity, including the employees and agents thereof, that is authorized by law, regulation, or government policy to engage in or supervise the prevention, detection, investigation, or prosecution of any violation of criminal law.
(3) “Location information” means information derived or otherwise calculated from the transmission or reception of any signal that reveals the approximate or actual geographic location of a customer, subscriber, or device.
(4) “Obtain in exchange for anything of value” means to obtain or receive access to personal data:
(i) In exchange for money or other valuable consideration;
(ii) In connection with services or benefits being provided as consideration; or
(iii) As part of the provision of a fee, including an access fee, service fee, maintenance fee, or licensing fee.
(5) “Personal data” means information collected from or generated by a specific person, as part of a consumer transaction or the use of a consumer product or service, that is linked or reasonably linkable to that specific person or that specific person’s electronic device. Personal data shall include, without limitation, a person’s:
(i) Name, billing information, social security number, billing address, or demographic data;
(ii) Web browsing or search history;
(iii) Application usage history;
(iv) Location information;
(v) Financial information;
(vi) Health information;
(vii) Biometric information;
(viii) Characteristics of protected classifications under state or federal law;
(ix) Device identifier, such as a media access control address, international mobile equipment identity, or Internet protocol address; and
(x) Communications’ content.
(6) "Third party" means a person who:
(i) Is not a governmental entity; and
(ii) Is not the person to whom the personal data pertains. 42-28.11-2. Prohibiting warrantless purchases of personal data.
(a) In connection with any criminal, civil, or other investigatory or enforcement activity:
(1) A law enforcement entity may not obtain or receive access to any individual’s personal data from a third party in exchange for anything of value.
(2) A law enforcement entity may not request, obtain, or receive access to any individual’s personal data from any federal, state, or local law enforcement or other government agency or department if such personal data was obtained from a third party in exchange for anything of value.
(3) A governmental entity, including a law enforcement entity, may not provide or share with any federal, state, or local law enforcement agency or department any individual’s personal data that was obtained from a third party in exchange for anything of value.
(4) Subsections (a)(1) through (a)(3) of this section shall not apply where:
(i) The law enforcement entity has obtained a valid, judicially issued, probable cause warrant for the personal data of a specifically identified, individual(s);
(ii) The law enforcement entity asserts, in good faith, that the exigent circumstance exception to warrant requirements applies due to an emergency involving imminent danger of death or serious physical injury to a person that requires disclosure without delay;
(iii) The personal data is lawfully available to the public through government records or widely distributed media;
(iv) The personal data pertains to a specific individual, was voluntarily made available to the public by that specific individual, and was obtained in compliance with all applicable laws, regulations, contracts, privacy policies, and terms of service;
(v) The specific individual to whom the personal data pertains intended law enforcement to be a recipient of the personal data, as evidenced by case specific, express consent from the specific individual;
(vi) The third party providing the data was authorized by the specific individual to whom the personal data pertains to provide the personal data to the law enforcement entity, as evidenced by case-specific, express consent from the specific individual; or
(vii) The personal data is being provided to or by the National Center for Missing and Exploited Children. (b)The attorney general shall adopt specific procedures that are reasonably designed to prevent the acquisition and retention, prohibit the dissemination, and require the prompt destruction of any individual’s personal data that is acquired by any governmental entity in violation of this section; however, such data shall be retained and may exclusively be used as evidence of a violation of this chapter. 42-28.11-3. Enforcement.
(a) Any violation of this chapter constitutes an injury, and any person may institute proceedings for injunctive relief, declaratory relief, a writ of mandate, and/or attorneys' fees in any court of competent jurisdiction to enforce this chapter.
(b) Any personal data acquired in violation of this chapter, and any evidence derived therefrom, may not be used, received in evidence, or otherwise disseminated in any investigation or in any trial, hearing, or other proceeding in or before any court, grand jury, or governmental entity, except as evidence of a violation of this chapter. 42-28.11-4. Severability.
(a) The provisions in this chapter are severable. If there is any part or provision of this chapter, or the application of this chapter to any person or circumstance, that is held invalid, the remainder of this chapter, including the application of such part or provisions to other persons or circumstances, shall not be affected by such holding and shall continue to have force and effect.
SECTION 3. This act shall take effect upon passage.
