S416 - Personal Privacy Protection Act. (SL 2025-79)

Overview: S.L. 2025‑79 (Senate Bill 416) enacts the "Personal Privacy Protection Act" as new Article 18 in the North Carolina Nonprofit Corporation Act.

Prohibited Agency Actions – Public agencies are prohibited from doing any of the following, except as otherwise required by law:

• Requiring any person or nonprofit organization to provide the agency with personal information or otherwise compelling its release.
• Releasing, publicizing, or otherwise publicly disclosing personal information in the agency's possession.
• Requesting or requiring a current or prospective agency contractor or grantee to list nonprofit organizations to which it has provided financial or nonfinancial support.

The term "personal information" is defined as "any list, record, register, registry, roll, roster, or other compilation of data of any kind that directly or indirectly identifies a person as a member, supporter, volunteer, or donor of financial or nonfinancial support to any nonprofit organization."

Penalties for Violations – A person alleging a violation of these provisions is entitled to bring a civil action in which the court can award injunctive relief; compensatory damages of not less than $2,500 per violation or three times that amount if the violation was intentional, and court costs, including reasonable attorney's fees and witness fees. In addition, a person who knowingly violates this Article will be guilty of a Class 2 misdemeanor.

If any provision or application of Article 18 is held invalid, then the invalidity does not affect other provisions or applications of Article 18 that can be given effect without the invalid provision or application.

This bill was vetoed by the Governor on July 9, 2025, and that veto was overridden by the General Assembly on July 29, 2025. This act becomes effective December 1, 2025, and applies to offenses committed on or after that date.