Some interesting points I gleamed from skimming the draft: 1. The way “small-to-medium” and “large” businesses or “entities” are defined. The bill separates en

Some interesting points I gleamed from skimming the draft: 1. The way “small-to-medium” and “large” businesses or “entities” are defined. The bill separates entities into 2 classes based on any of 3 factors: annual revenue, number of users, and percentage of revenue from the sale of consumer information. So even if you’re a one-person startup with 20 users, if you make the larger part of your revenue from consumer data, you are considered a large entity. The extra compliance requirements for large entities seem quite onerous. 2. Two levels of personal information. This might be pre-existing in U.S. code (I don’t know) but the bill defines a separate category of “sensitive information,” that is quite broad, including data on your health, geolocation, biometric markers, finances, children, private communications, and government IDs. All other data that is not encrypted or de-identified is “personal information.” 3. Most of the rights and procedures defined in the bill apply only to personal information, and there are many exceptions, such as “performing a task carried out in the public interest.” So you have no right to privacy if the entity believes sharing your data will be in the public interest? 4. No rights or restrictions apply to the collection and usage of “sensitive information” except that “express prior consent” and “separate consent” are given before collection, use, and sharing of it. I would have expected there to be more rules and restrictions around the sensitive data, not less. It seems to me that very little of what today’s companies collect would be considered “personal information” according to this bill. Most of it would either be disqualified by encryption or de-identification, or fall under sensitive information.