Legislators in Mississippi recently introduced SB 2548. the “Mississippi Consumer Data Privacy Act.” The bill contains provisions similar to the California Consumer Privacy Act but goes further than the CCPA with a lower annual gross revenue threshold, applying to any for-profit business, or any entity that controls or is controlled by such a business, that does business in Mississippi and:
- Has annual gross revenues in excess of $10 million (instead of $25 million);
- Alone or in combination, annually buys, receives for the business’s commercial purposes, sells or shares for commercial purposes, alone or in combination, the personal information of 50,000 or more consumers, households or devices; or
- Derives 50% or more of its annual revenues from selling consumers’ personal information.
The legislation would provide consumers the right to know and request deletion of personal information collected about them and to opt-out of the sale of their personal information. It includes CCPA-like requirements for submitting, receiving and verifying consumer requests.
The legislation does not include any exemptions for businesses or personal information subject to HIPAA, FCRA or GLBA.
The legislation provides for a 30-day opportunity to cure, a private right of action in the event of a breach for statutory damages of $100 to $750 or actual damages, whichever is greater, and civil penalties of up to $7,500 for each violation.
The legislation would become effective July 1, 2021, and the attorney general is tasked with rulemaking.
