Summary
Creates profiling opt-out and explanation rights for consequential decisions, including healthcare services, and requires impact assessments. Privacy notices must disclose personal-data use for large-language-model training.
Healthcare Implications
Nonexempt health-related controllers face automated-decision rights and governance duties. Qualifying providers, facilities, insurers, third-party administrators, and protected health information have exemptions. The housing-only reevaluation right is not a general healthcare human-review right.
Operational Implications
- Document impact assessments for consequential profiling; assessment requirements apply to processing created or generated after January 1, 2028.
- Provide detailed consequential-profiling impact assessments to the Attorney General on request during an investigation; assessments are confidential.