Bill: Draft General Data Privacy Regulatory Fix Act

[Just_Jada]

A
BILL
To

Amend the Privacy Act and Establish Legitimate Interest as a Basis for Processing Information
The people of the Commonwealth of Redmont, through their elected Representatives in the Congress and the force of law ordained to that Congress by the people through the constitution, do hereby enact the following provisions into law:

1 - Short Title and Enactment

(1) This Act may be cited as the 'General Data Privacy Regulatory Fix Act.'

(2) This Act shall be enacted immediately upon its signage.

(3) This Act has been authored by Vice President Multiman155.

(4) This Act has been sponsored by Just_Jada and co-sponsored by True_Darklander.

2 - Reasons
(1) The relationship between Section 6 and 9 in the Privacy Act could use a bit of clarity;
(2) Legitimate interest basis for processing and collecting data should be established;
(3) Privacy rights under statute ought be subject to reasonable limitations; and
(4) Other general fixes to the way rights are handled in the Privacy Act would improve the Act.

3 - Amendments to Section 4 of the Privacy Act
(1) Section 4 of the Privacy Act is Amended as follows:

4 - Definitions
(1) For the purposes of this Act, "personal information" and "private information" shall have the same meaning and refer to any information relating to an identifiable individual, including but not limited to:
(a) Employment details, discipline records, termination details, and administrative actions
(b) Financial records with private organisations, including but not limited to:
(i) Account balances
(ii) Transaction history
(iii) Debts and other assets
(2) Personal information and Private information do not include:
(a) Information that is freely and publicly available
(b) Information that has been anonymised or aggregated such that it cannot reasonably identify any individual
(c) Information displayed on public leaderboards, statistics pages, or BlueMap
(d) Information voluntarily posted by the individual in a public area, except for real-life personal information as protected under Section 8
(3) For the purposes of this Act, "Permanently deported" means any ban issued by server staff with no defined expiration date, or any ban issued as a final enforcement action.
(4) "Processing", in the context of personal or private information within this Act, shall include "any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organizing, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction thereof"

4 - Amendments to Section 5(1) of the Privacy Act
(1) Section 5(1) of the Privacy Act is Amended as follows:

(1) The following Privacy Principles govern the collection, use, storage, and disclosure processing of personal information:

5 - Amendments to Section 6 of the Privacy Act
(1) Section 6 of the Privacy Act is Amended as follows:

6 - Privacy Rights
(1) The following Privacy Rights are afforded to all individuals and organisations:
(a) To be informed of why your personal information is being collected, how it will be used, how it will be stored, and who it will be disclosed to, before or at the time of collection;
(i) When practicable, such disclosure shall be made before or at the time of collection, unless such disclosure may adversely impact interests identified under subsection (2);
(b) To have the option of not identifying oneself, or of using a pseudonym in certain circumstances where it is lawful and practicable to do so;
(c) To request and receive access to your personal information held by any organization or government entity within a reasonable timeframe;
(d) To request that your personal information that is incorrect or incomplete be corrected or updated, and have such requests processed in a timely manner;
(e) To make a complaint about an organisation or agency, if you think they’ve mishandled your personal information, and have such complaints investigated and addressed;
(f) To request deletion of your personal information where it is no longer required for the purpose for which it was collected, subject to legal retention requirements;
(g) To withdraw consent for the use or disclosure of your personal information at any time, subject to legal or contractual restrictions; and
(h) To seek damages through civil proceedings for any breach of this Act where you have suffered quantifiable loss or harm.
(2) Privacy rights are subject to reasonable limitations, which shall include reasonable limitations to avoid adverse impacts to:
(1) public safety;
(2) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
(3) the protection of judicial independence and judicial proceedings;
(4) the prevention, investigation, detection and prosecution of breaches of government or professional ethics standards;
(5) the ordinary operation of server macros, plugins, or in-game commands;
(6) the protection of the data subject or the rights and freedoms of others;
(7) the enforcement of civil law claims;
(8) the safeguarding of public security or national security;
(9) other important objectives of general public interest of the Commonwealth; or
(10) other processing compliant with Section 9 of this Act.

6 - Amendments to Section 9 of the Privacy Act
(1) Section 9 of the Privacy Act is Amended as follows:

9 - Processing of Personal Information Disclosure
(1) An organization or agency may process can’t use or disclose personal information unless an exception applies.
(2) Exceptions include of a data subject protected under Section 6 only when at least one of the following is the case:
(a) The subject has provided informed consent to the organisation or agency using or disclosing their personal information;
(b) The processing disclosure is required or permitted by lawstatute, department policy, or court order;
(c) The information is shared as part of official Congressional or Court proceedings;
(d) The information is general in nature and does not identify or could not reasonably identify any specific individual;
(e) The processing disclosure is necessary for the performance of a task carried out in the public interest or in the exercise of official authority, including but not limited to for law enforcement purposes or the investigation of suspected criminal activity;
(f) Criminal records, which may be requested from or released by the Department of Homeland Security;
(g) Processing is necessary for the purposes of the legitimate interests pursued by the data processor;
(h) Processing is necessary for the performance of a contract to which the data subject is a party;
(2) Any disclosure of personal information permitted under subsection (1) must be limited to the minimum information necessary to achieve the authorized purpose.
(3) Processing of information under subsection (1) shall be permitted except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.
6 - Amendments to Section 11 of the Privacy Act
(1) Section 11 of the Privacy Act is Amended as follows:

11 - Exemption for Deported Players
(1) Individuals who have been permanently deported are not entitled to the protections afforded by this Act.
(2) This exemption applies to the provisions under Section 6 and Section 7 and protections against disclosureprocessing of personal information under Section 9.
(3) Government entities and private organizations are not obligated to maintain the confidentiality of information relating to individuals covered by this exemption.
(4) This exemption does not authorize the disclosure of any real-life personal information in accordance with Section 78.