H. B. 4279

(By Delegate Manypenny, Sponaugle, Skinner, Barrett, Eldridge, Ellem and Guthrie)

         [Introduced January 23, 2014; referred to the

         Committee on the Judiciary then Finance.]

A BILL to amend the Code of West Virginia, 1931, as amended, by adding thereto a new article, designated §61-14-1, §61-14-2, §61-14-3, §61-14-4, §61-14-5 and §61-14-6, all relating to creating the Citizen Privacy and Internet Activity Act; prohibiting the sale of online Internet activity to third parties; providing a short title; making legislative findings; defining terms; declaring public policy; and establishing criminal penalties.

Be it enacted by the Legislature of West Virginia:

    That the Code of West Virginia, 1931, as amended, be amended by adding thereto a new article, designated §61-14-1, §61-14-2, §61-14-3, §61-14-4, §61-14-5 and §61-14-6, all to read as follows:

ARTICLE 14. Citizen Privacy and Internet Activity Act.

§61-14-1. Short Title.

    This article shall be known and may be cited as the "Citizen Privacy and Internet Activity Act".

§61-14-2. Legislative findings.

    (a) The Legislature hereby finds and declares:

    (1) Online Internet activities, including cloud computing, enable convenient, on-demand access to a shared pool of configurable computing resources, including networks, servers, storage, applications and services;

    (2) Online Internet activities, including cloud computing services, offer tremendous potential to individual, business and educational institutions in terms of helping consolidate technical infrastructure, reducing energy and capital costs, increasing collaboration through "anytime-anywhere" access to applications and information, and realizing efficiencies, network resilience, and flexible deployment; and

    (3) Online Internet activities, including cloud computing services, hold the potential to invade the privacy of individuals by tracking and selling users’ online activities for commercial purposes, such as delivering behaviorally targeted advertising or otherwise altering advertising services that a website, cloud computing provider or Internet provider may offer in connection with or separate from the services it offers to the individual, business and educational institutions.

    (b) Therefore, the Legislature deems it necessary to ensure that when an individual, business or educational institution engages in an online Internet activity, including visiting websites, using an Internet search engine or cloud computing services or utilizing an Internet provider, that the service provider, website or search engine may use that online activity data only for its own benefit or the benefit of that individual, business or educational institution, and may not sell or otherwise transfer that data to a third party.

§61-14-3. Definitions.

    "Business" means any corporation, partnership, limited partnership, limited liability partnership, professional limited liability partnership, limited liability company, professional limited liability company, joint venture, business trust or any other form of business organization, including nonprofit organizations.

    "Cloud computing service" means a service that enables convenient, on-demand network access to a shared pool of configurable computing resources to provide an individual, business or educational institution account-based productivity applications such as email, document storage and document editing that can be rapidly provisioned and released with minimal management effort or cloud computing service provider interaction.

    "Cloud computing service provider" means an entity, other than an educational institution, that operates a cloud computing service.

    "Data" means any information or materials in any media or format created or provided by a person in the course of using the Internet provider, search engine, cloud computing service or website through online activity. In each case the term "data" shall include, but not be limited to the name, electronic mail address, postal address, phone number, email message, documents, unique identifiers, Internet and website searches, results of Internet and website searches, metadata, or any aggregations or derivatives thereof.

    "Educational institution" means any public or nonpublic school, charter school, school district or board of cooperative educational services serving students in secondary and post-secondary schools.

    “Internet” means an electronic communications network that connects computer networks and organizational computer facilities around the world.

    “Internet provider” means a business or organization that offers users access to the Internet and related services.

    “Internet search engine” means a software system that is designed to search for information on the World Wide Web. The search results are generally presented in a line of results often referred to as search engine results pages. The information may be a specialist in web pages, images, information and other types of files. Some search engines also mine data available in databases or open directories. Unlike web directories, which are maintained only by human editors, search engines also maintain real-time information by running an algorithm on a web crawler.

    “Online activity” means any activity that is engaged in while accessing the Internet via an Internet provider or, once having accessed the Internet, any activity using an Internet search engine or cloud computing service, or any activity while on a website or the World Wide Web.

    "Person" means individual, business, partnership, corporation, association, company or any other legal entity.

    "Process" or "processing" means to use, access, manipulate, scan, modify, transform, disclose, store, transmit, transfer, retain, aggregate or dispose of data.

    “Website” means a set of interconnected webpages, usually including a homepage, generally located on the same server, and prepared and maintained as a collection of information by a person, group or organization.

§61-14-4. Prohibition on the use of data.

    Any person who, with knowledge that online activity data will be processed, provides Internet access, provides a cloud computing service to individuals, businesses or educational institutions or a websites that permits individuals, businesses or educational institutions to access its site are prohibited from using data or information on the user to track or process online activity data for any secondary uses that benefits any third party, including, but not limited to, online behavioral advertising, creating or correcting an individual or household profile, the sale or transfer of the data to a third party for any commercial purpose, or any other similar commercial for-profit activity. However, an Internet provider, search engine, cloud computing service provider or website may process or monitor data solely to provide its contracted service to the individual, business or educational institution and maintain the integrity of the service.

§61-14-5. Waivers against public policy.

    Any contract, agreement or stipulation which endeavors to limit or waive the requirements and prohibitions of this article is contrary to the public policy of this state and that portion of the contract, agreement or stipulation is null and void and of no effect.

§61-14-6. Criminal penalties.

    (a) An Internet provider, website, Internet search engine, cloud computing service provider or other person who sells or otherwise transfers online activity data or online activity information to a third party or permits another person to sell or otherwise transfer that information is guilty of a misdemeanor and, upon conviction, shall be punished in accordance with subsection (c) of this section.

    (b) Each separate piece or item of data or online activity or information sold or transferred in violation of this article is a separate actionable offense.

    (c) A person convicted of a misdemeanor under this section shall be punished as follows:

    (1) Upon a first conviction under this section, the defendant shall be fined not less than $1,000, nor more than $5,000.

    (2) Upon a second conviction under this section, the defendant shall be fined not less than $5,000, nor more than $10,000, or confined in jail for not more than thirty days, or both fined and confined.

    (3) Upon a third conviction under this section, the defendant shall be fined not less than $10,000, nor more than $25,000, or confined in jail for not less than sixty days, nor more than one year, or both fined and confined.

    NOTE: The purpose of this article is to create the "Citizen Privacy and Internet Activity Act.” The bill defines terms. The bill prohibits the sale of online Internet activity to third parties. The bill provides a short title. The bill makes legislative findings. The bill declares public policy and establishes criminal penalties.

    This article is new; therefore, it has been completely underscored.