Senate Bill ('SB') 569 for the Consumer Privacy Act was introduced, on 6 April 2021, at the North Carolina State Senate. In particular, the bill would apply to persons that conduct business in the State or produce products/services that are targeted to residents and that either during a calendar year, control or process personal data of at least 100,000 consumers or control or process personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data. Furthermore, the bill has five specified consumer rights, which include the right to be informed, to correction and deletion of data, data portability, and to opt-out of the processing of personal data for purposes of targeted advertising. In addition, the bill would provide for data controller obliglations, such as:

• to create an online mechanism for consumers to file complaints regarding denied appeals to the Attorney General ('AG');
• provide consumers with a reasonably accessible, clear, and meaningful privacy notice;
• establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data; and
• annually conduct and document a data protection assessment with the potential risks of the consumer and a cybersecurity analysis.

Lastly, the bill also provides for, among other things:

• a 30 days' notice period to violators to cure violations as specified by the bill;
• authorises the AG to seek an injunction and impose a civil penalty of up to $5,000 for each violation following the cure period or breach of an express written statement provided by the violator;
• an injured person seeking damages to bring a civil action for injunction, and permits the award of reasonably attorneys' fees to the prevailing party; and
• grants the right to recover damages.

You can read the bill here and track its progress here.