Keypoint: There were four notable developments this week: the Florida House passed a bill out of committee, lawmakers proposed a new bill in Texas, the Washington Privacy Act was  scheduled for a public hearing and committee session on March 17 and 19, respectively, and the Illinois Right to Know Act was scheduled for a March 19 hearing in the Cybersecurity, Data Analytics & IT Committee.

For the third week in a row, we are providing an update on the status of proposed CCPA-like privacy legislation. Before we get to our update, we wanted to provide three reminders.

First, we hosted a webinar on Virginia’s Consumer Data Protection Act on March 11. You can access the recording here.

Second, we have been regularly updating our 2021 State Privacy Law Tracker to keep pace with the latest developments. We encourage you to bookmark the page for easy reference.

Third, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated.

What’s New

There were four notable developments this week.

First, Florida’s HB 969 unanimously passed out of the House Regulatory Reform Committee. However, during the March 10 committee hearing, the bill sponsor made it clear that the bill is a work in progress. In fact, lawmakers approved five amendments to the bill prior to passage.

Second, in Texas, Representative Capriglione filed six bills “related to increasing the protection of consumer data by the private sector.” One bill, HB 3741, is a data privacy omnibus bill. As introduced, the bill is perhaps best described as a heavily modified version of the CCPA, however, there are many aspects of the bill that make it unique, including its creation of three “categories” of data.

The bill would provide Texas residents with the right to know, right to correct inaccurate information, right to access, right to data portability, and right to deletion. It also contains a provision that would permit individuals to provide their “data stream” as “consideration under a contract.” Further, the bill would restrict a business’s sale and collection of certain types of data and require “express written consent” for the collection and sale of geolocation data. The Texas Attorney General’s office would enforce the bill and could seek “a civil penalty in an amount of not more than $10,000 for each violation, not to exceed a total of $1 million.” Many thanks to Steve Perkins for alerting us to the filing of the Texas bills.

Third, the Washington Privacy Act is now scheduled for a public hearing in the House Committee on Civil Rights & Judiciary on March 17 and an executive committee session on March 19.

Finally, in Illinois, HB 2402 was assigned to the Cybersecurity, Data Analytics, & IT Committee and is currently scheduled for a hearing on March 19.

Overview

To date, state lawmakers have introduced bills in 20 states. Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington are considering multiple bills. One state (Virginia) has passed legislation whereas the bills in three states (North Dakota, Mississippi, and Utah) have failed.

The below analysis divides the bills into four categories: (1) passed bills, (2) active bills, (3) introduced bills, and (4) dead bills.

Passed bills are those that have become law (i.e., Virginia). Active bills are those that have seen some movement, such as a committee hearing or vote. Introduced bills are those that have been introduced in a state legislature but have yet to see any movement (other than, for example, being referred to a committee). Dead bills are (as you might have guessed) bills that have failed.

For links to all of these bills please see our 2021 State Privacy Law Tracker.

Passed Bills

Virginia

On March 2, 2021, Virginia became the second state – after California – to enact state consumer data privacy legislation. You can find our coverage of the Virginia bill here, and you can find the text of the new law here. We also hosted a webinar on the law on March 11. You can access the recording here.

Active Bills

Washington

The Washington Senate passed the 2021 version of the Washington Privacy Act (WPA) on March 3. The bill is now with the House and is scheduled for a public hearing in the House Committee on Civil Rights & Judiciary on March 17, and an executive committee session on March 19.

The People’s Privacy Act (a competing bill supported by the ACLU of Washington) has not seen movement since February 1.

Oklahoma

The Oklahoma House passed a revised version of the Oklahoma Computer Data Privacy Act on March 4. The bill is now in the state senate. You can find a summary of the bill here.

A related bill, HB 1125, also passed the House and is in the state senate. That bill would amend the Oklahoma Consumer Protection Act to make it unlawful for a person to knowingly make “false or misleading statements in a privacy policy, published on the Internet or other distributed or published, regarding the use of personal information submitted by members of the public.”

Connecticut

Senate Bill 893 introduced on February 17 and Senate Bill 156 introduced on January 15 have not seen any new movement. Both bills are with the Joint General Law Committee, which held a public hearing on February 25.

Senate Bill 893 is similar to Virginia’s Consumer Data Protection Act. As introduced, Senate Bill 156 is just a one-paragraph bill.

Florida

We moved Florida into the active category this week. As discussed, the House Regulatory Reform Committee unanimously passed HB 969 out of committee. A second bill, SB 1734, filed on February 25, 2021, is in committee.

HB 969 is perhaps best described as a heavily modified version of the California Privacy Rights Act (CPRA), while SB 1734 is perhaps best described as a heavily modified version of the CCPA.

Illinois

We also decided to move Illinois into the active category this week after HB 2404 (the Right to Know Act) was assigned to the Cybersecurity, Data Analytics, & IT Committee and the committee scheduled a hearing on the bill for March 19. As its name suggests, the Right to Know Act would provide Illinois residents with the right to know certain information regarding their personal information.

In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (entitled the Consumer Privacy Act) on February 22. That bill is assigned to the Rules Committee. HB 3910 is a modified version of the CCPA.

Introduced Bills

Alabama

House Bill 216 was introduced on February 2, 2021. Notably, the bill has attracted 18 Republican sponsors or co-sponsors. However, to date, it has not moved forward and is currently referred to the House committee on Technology and Research. The bill is similar to the CCPA.

Arizona

HB 2865 was introduced on February 11, 2021. To date, there have been no hearings or votes taken on the bill. The bill is currently pending in the House Commerce Committee. The bill does not readily track the form or contents of either the CCPA or the Virginia and Washington bills.

Kentucky

House Bill 408 was introduced on February 9, 2021 and referred to the Committee on Committees—it has not moved since. In general, the bill focuses on requiring businesses to provide privacy policy disclosures and allowing state residents to opt out of the sale of their personal information. The Kentucky legislature closes on March 30.

Maryland

SB 930 (the Maryland Online Consumer Protection Act) was introduced on February 10, 2021. No action has been taken to date. The bill is a modified version of the CCPA.

Massachusetts

SD 1726 was filed on February 18, 2021. It does not appear that any action has been taken on the bill to date. The bill is a modified version of Washington’s People’s Privacy Act. A second bill, HD 3847, was filed in the state house.

Minnesota

Minnesota is interesting insofar as it was one of the first states to see legislation proposed this year (HF 36 proposed on January 7, 2021), but then lawmakers introduced a second bill (HF 1492) more than a month later on February 22, 2021. Neither bill has seen movement since being introduced.

HF 36 is a modified (and shortened) version of the CCPA and contains a private right of action. HF 1492 is similar to the Washington and Virginia bills.

New York

As shown on our tracker, New York legislators have proposed a number of consumer privacy bills in 2021. All of those bills currently sit in committee. In addition, Governor Cuomo’s privacy legislation (see page 148) is still active.

Rhode Island

House Bill 5959 was introduced on February 26, 2021. It is currently pending in committee. The bill would require certain companies to provide privacy policy disclosures.

South Carolina

H 3063 was pre-filed on December 9, 2020 and referred to the Committee on Labor on January 12, 2021. It has not moved since. The bill is limited to providing rights around the collection and use of biometric information.

Texas

As discussed, last week Representative Capriglione introduced HB 3741. Please see our discussion of the bill in the “What’s New” section above.

Vermont

H.160 is still a short form bill (i.e., only one paragraph long). The bill has been referred to committee and no further action has been taken to date.

Dead Bills

North Dakota’s HB 1330, Mississippi’s Senate Bill 2612, and Utah’s SB 200 have all died.