A BILL TO BE ENTITLED
AN ACT to enact the Internet privacy POLICY act.
The General Assembly of North Carolina enacts:
SECTION 1.  Article 3D of Chapter 147 of the General Statutes is amended by adding a new Part to read:
"Part 5. Internet Privacy Policy Act.
"§ 147-33.110.  Definitions.
As used in this Part:
(1)	'Disclose' or 'disclosure' means to make personal information known, including by sale or rental of the information.
(2)	'Interactive computer service' means the offering of a capability for web-browsing, generating, acquiring, storing, transforming, processing, retrieving, utilizing, transferring or making available information using computer-based telecommunications or via modem or wireless system to the internet.
(3)	'Internet' means a system of linked computer networks, international in scope, that facilitates data transmission and exchange.
(4)	'Personal information' means:
a.	Information which identifies a specific user or the user's interactive computer service address; or
b.	Information collected or submitted via the internet that identifies a user's home or work address, e-mail address, telephone number, credit or debit card information, social security number, birth date, gender, marital status or other personal identifier.
The term shall not include any record of aggregate data which does not identify, either directly or indirectly, a user or the user's interactive service address.
(5)	'State agency' means a State agency as defined by G.S. 147-33.81(6).
(6)	'User' means any person who uses a computer capable of interacting with the internet.
"§ 147-33.111.  Internet privacy policy.
(a)	Internet Privacy Policy and Consent Required. Any State agency that provides an interactive computer service shall not collect or disclose personal information concerning a user to any person, firm, partnership, corporation or other entity, including internal agency staff who do not need the information in the ordinary course of business of the agency's mission, unless the user expressly states that he or she:
(1)	Has received the notice provided for in subsection (b) of this section; and
(2)	Has consented to the collection or disclosure.
(b)	Contents of Internet Privacy Policy. At the time when a State agency is first contacted by a user to provide any on-line interactive computer service, including browsing a site, the State agency shall provide notice in the form of a separate statement to the user clearly and conspicuously disclosing the following to the user:
(1)	The personal information collected or to be collected with respect to the user and the use of the information, if any;
(2)	The nature, frequency and purpose of any disclosure which may be made of such information, including an identification of the types of persons or person to whom such disclosure may be made, and whether or not user consent is required for each disclosure;
(3)	Whether the information will be maintained, and, if so, the period of time the information will be maintained, or a statement that such period cannot be determined;
(4)	A description of the procedures by which the user may gain access to the information;
(5)	A description of the means of information collection and whether such collection occurs actively or passively;
(6)	Notice indicating if the requested information or data is voluntary or required, and the consequences of a refusal to provide the requested information; and
(7)	The steps being taken by the State agency to ensure the confidentiality and integrity of the data.
(c)	Access to Personal Information. Upon request a user shall be provided access to all personal information regarding the user that is collected and maintained by a State agency via an interactive computer service, except as otherwise provided by law, the information shall be made available at reasonable times and at a location reasonably convenient to the user. When convenient, the State agency shall seek to provide the information to the user via computer-based telecommunications. The user shall be provided reasonable opportunity by the interactive computer service to correct errors in personal information and the interactive computer service shall promptly correct the information.
(d)	Model Internet Privacy Policy. The Office of Information Technology Services shall develop a model on-line sample privacy notice, which shall be made available to every State agency, and which may be made available to other public or private entities. The model on-line privacy notice shall include, but not be limited to, the information required by subsection (b) of this section.
(e)	Exceptions. A State agency may disclose personal information if the disclosure is:
(1)	Necessary in the ordinary course of business as defined in applicable State law;
(2)	Made pursuant to a court order or by law;
(3)	For the purpose of validating the identity of the user; and
(4)	If the information or data is used solely for statistical purposes in aggregate form.
"§ 147-33.112.  Construction.
Nothing in this Part shall abridge public access to information available by law as a public record. Nothing in this Part shall authorize the disclosure of confidential information otherwise protected by law."
SECTION 2. This act is effective when it becomes law.