Idaho Data Center Privacy and Consent Act

AN ACT REQUIRING INFORMED CONSENT AND PERSONAL PRIVACY PROTECTIONS IN SERVICE LEVEL AGREEMENTS GOVERNING DATA CENTER PROCESSING OF PERSONAL DATA, TO MINIMIZE RISK AND REDUCE HARM TO IDAHO CONSUMERS. BE IT ENACTED BY THE PEOPLE OF THE STATE OF IDAHO: SECTION 1. TITLE AND PURPOSE. This Act shall be known and may be cited as the "Idaho Data Center Privacy and Consent Act." Its purpose is to protect the personal privacy of Idaho residents by requiring clear, informed consent before personal data is collected, processed, or shared under any service level agreement (SLA) governing data center processing of personal data, and to minimize risk and reduce harm by establishing minimum transparency, accountability, and consumer-rights standards for such agreements. SECTION 2. FINDINGS. The people of the State of Idaho find that: (a) Idaho residents increasingly rely on digital services — cloud computing, artificial intelligence platforms, data hosting, software-as-a-service, and telecommunications — that collect, process, and store vast quantities of personal information; (b) The service level agreements governing these services are routinely presented as non-negotiable terms of use, written in dense legal language that the average consumer cannot reasonably understand, evaluate, or contest; (c) These agreements frequently authorize the collection, use, sharing, and sale of personal data — including biometric identifiers, location records, health information, financial data, and communications metadata — without meaningful notice or genuine, freely given consent; (d) The concentration of hyperscale data center processing infrastructure within Idaho amplifies these risks, exposing Idaho residents to heightened surveillance, data breach, and algorithmic decision-making harms without corresponding legal protections; (e) Idaho currently lacks comprehensive statutory protections governing how personal data is handled within service level agreements governing data center processing, leaving consumers to bear the full risk of harm from unauthorized collection, misuse, breach, and sale of their information; (f) The absence of informed-consent and privacy protections in SLAs constitutes an unreasonable and preventable risk to the liberty, dignity, and economic security of Idaho residents, and warrants legislative action to minimize that risk and reduce resulting harm. SECTION 3. DEFINITIONS. For purposes of this Act: (a) "Personal data" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular Idaho resident or household, including but not limited to names, addresses, online identifiers, biometric data, geolocation data, health records, financial information, and communications content or metadata. (b) "Service level agreement" or "SLA" means any contract, terms of service, privacy policy, end-user license agreement, or similar instrument — whether presented as a click-through, browse-wrap, shrink-wrap, or signed document — that governs the collection, processing, storage, transmission, sharing, or sale of personal data by a data center operator, service provider, data processor, or data controller. (c) "Processing" means any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure by transmission, dissemination, alignment, combination, restriction, erasure, or destruction. (d) "Informed consent" means a clear, affirmative, freely given, specific, and unambiguous indication of a resident's wishes, obtained after the resident has been provided with a plain-language summary of the data practices at issue, by which the resident signifies agreement to the processing of personal data relating to them. (e) "Service provider" means any entity that offers, provides, or operates a digital service governed by an SLA and that collects, processes, or controls personal data of Idaho residents. SECTION 4. INFORMED CONSENT REQUIREMENTS. No service provider shall collect, process, share, or sell the personal data of an Idaho resident pursuant to a service level agreement unless: (a) The resident has been provided with a plain-language privacy notice, not exceeding the equivalent of two pages, that clearly identifies the categories of personal data to be collected, the purposes of processing, any third parties with whom the data will be shared, whether the data will be sold, and the resident's rights under this Act; (b) The resident has given informed consent to each distinct purpose for which the personal data will be processed, obtained separately from any general terms of acceptance and not as a precondition of receiving the service unless the processing is strictly necessary to provide the service requested; (c) Consent is obtained through a clear, affirmative action — pre-checked boxes, bundled consents, and continued-use presumptions do not constitute informed consent; (d) The resident is given a simple, accessible mechanism to withdraw consent at any time, with the same ease with which it was given, and withdrawal of consent does not affect the lawfulness of processing prior to withdrawal. SECTION 5. PROHIBITED PRACTICES. A service level agreement governing the personal data of Idaho residents shall not: (a) Authorize the sale or sharing of personal data to third parties for targeted advertising without separate, informed, opt-in consent; (b) Authorize the processing of sensitive personal data — including biometric identifiers, health information, financial account credentials, precise geolocation, and the content of communications — without separate, informed, opt-in consent; (c) Contain provisions that purport to waive, limit, or restrict a resident's rights under this Act, including any right to bring a civil action for damages caused by a violation; (d) Require arbitration of disputes arising under the SLA in a forum outside the State of Idaho or under the law of another jurisdiction; (e) Permit the transfer of personal data to a foreign government or any entity subject to the legal compulsion of a foreign government without the informed consent of the resident. SECTION 6. CONSUMER RIGHTS. Every Idaho resident shall have the right to: (a) Access and obtain a copy of the personal data a service provider has collected about them; (b) Request correction of inaccurate personal data; (c) Request deletion of their personal data, subject to limited exceptions where retention is required by law; (d) Obtain a list of the third parties to whom their personal data has been disclosed or sold; (e) Opt out of the sale or sharing of their personal data for targeted advertising; (f) Receive notice of any data breach affecting their personal data within thirty (30) days of the service provider's discovery of the breach. SECTION 7. ENFORCEMENT. (a) A violation of this Act constitutes an unfair or deceptive act or practice in trade or commerce and is enforceable under the Idaho Consumer Protection Act, Idaho Code title 48, chapter 6. (b) Any Idaho resident aggrieved by a violation of this Act may bring a civil action in a court of competent jurisdiction to recover actual damages, statutory damages of not less than one hundred dollars ($100) and not more than one thousand dollars ($1,000) per violation, reasonable attorney's fees, and costs, and to seek injunctive relief. (c) The Attorney General of the State of Idaho shall have authority to investigate and prosecute violations of this Act and may seek civil penalties of up to seven thousand five hundred dollars ($7,500) per intentional violation. SECTION 8. EXEMPTIONS. This Act shall not apply to: (a) Personal data collected, processed, or maintained solely for the purpose of complying with federal or state law; (b) Personal data of employees collected in the employment context, to the extent governed by other applicable law; (c) Financial institutions and data subject to the Gramm-Leach-Bliley Act to the extent of actual conflict with federal law; (d) Health information subject to the Health Insurance Portability and Accountability Act (HIPAA) to the extent of actual conflict with federal law. SECTION 9. SEVERABILITY. If any provision of this Act, or its application to any person or circumstance, is held invalid, the invalidity does not affect other provisions or applications of the Act that can be given effect without the invalid provision or application, and to this end the provisions of this Act are severable. SECTION 10. EFFECTIVE DATE. This Act shall take effect on July 1 following its passage and approval by the voters of the State of Idaho.