Keypoint: It was another busy week with bills introduced in Colorado, New York and West Virginia, a committee hearing in New Jersey on three bills, a public hearing in Washington on the Washington Privacy Act, the Oklahoma bill was referred to the Senate Judiciary committee, one Florida bill passed out of committee, and a hearing was set on the other Florida bill.
For the fourth week in a row, we are providing an update on the status of proposed CCPA-like privacy legislation. Before we get to our update, we wanted to provide three reminders.
First, there has been so much debate about what to call Virginia’s new privacy law – the Virginia Consumer Data Protection Act – that we started an online poll. Tell us whether you think the law should be called the CDPA or VCPDA. We will keep voting open until April 2 and release the results on our blog.
Second, we have been regularly updating our 2021 State Privacy Law Tracker to keep pace with the latest developments. We encourage you to bookmark the page for easy reference.
Third, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated.
On March 19, 2021, Colorado lawmakers introduced the Colorado Privacy Act (SB21-190). You can read our analysis of the bill here.
In Florida, HB 969 was added to Civil Justice & Property Rights Subcommittee meeting set for March 23, 2021. As reported in our prior post, the Regulatory Reform Subcommittee previously passed the bill. Meanwhile, SB 1734 passed out of the Senate Commerce and Tourism Committee on March 22. Many thanks to Joe Duball from the IAPP for alerting us to these developments.
In New Jersey, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255) on March 15. A recording of the hearing is available here.
In New York, lawmakers introduced the Digital Fairness Act (A6042).
In Oklahoma, the Oklahoma Computer Data Privacy Act was referred to the Senate Judiciary committee.
In Washington, the House Committee on Civil Rights & Judiciary held a public hearing on the Washington Privacy Act on March 17. The bill is scheduled for an executive committee session on March 26.
Finally, in West Virginia, lawmakers introduced HB 3159 on March 15, 2021. The bill was referred to the House Judiciary Committee. It is similar to the CCPA.
To date, state lawmakers have introduced bills in 23 states. Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington are considering multiple bills. One state (Virginia) has passed legislation whereas the bills in three states (North Dakota, Mississippi, and Utah) have failed.
The below analysis divides the bills into four categories: (1) passed bills, (2) active bills, (3) introduced bills, and (4) dead bills.
Passed bills are those that have become law (i.e., Virginia). Active bills are those that have seen some movement, such as a committee hearing or vote. Introduced bills are those that have been introduced in a state legislature but have yet to see any movement (other than, for example, being referred to a committee). Dead bills are (as you might have guessed) bills that have failed.
For links to all of these bills please see our 2021 State Privacy Law Tracker.
On March 2, 2021, Virginia became the second state – after California – to enact state consumer data privacy legislation. You can find our coverage of the Virginia bill here, and you can find the text of the new law here. We also hosted a webinar on the law on March 11. You can access the recording here.
The Washington Senate passed the 2021 version of the Washington Privacy Act (WPA) on March 3. The House Committee on Civil Rights & Judiciary held a public hearing on the Washington Privacy Act on March 17. The bill is scheduled for an executive committee session on March 26 (previously scheduled for March 19).
The People’s Privacy Act (a competing bill supported by the ACLU of Washington) has not seen movement since February 1.
The Oklahoma House passed a revised version of the Oklahoma Computer Data Privacy Act on March 4. The bill is now in the state senate where it was referred to the Senate Judiciary Committee on March 22. You can find a summary of the bill here.
Senate Bill 893 introduced on February 17 and Senate Bill 156 introduced on January 15 have not seen any new movement. Both bills are with the Joint General Law Committee, which held a public hearing on February 25.
Senate Bill 893 is similar to Virginia’s Consumer Data Protection Act. As introduced, Senate Bill 156 is just a one-paragraph bill.
HB 969 was added to Civil Justice & Property Rights Subcommittee meeting set for March 23, 2021. As reported in our prior post, the bill previously passed out of the Regulatory Reform Subcommittee. Meanwhile, SB 1734 passed out of the Senate Commerce and Tourism Committee on March 22.
HB 969 is perhaps best described as a heavily modified version of the California Privacy Rights Act (CPRA), while SB 1734 is perhaps best described as a heavily modified version of the CCPA.
Illinois is considering two bills.
First, HB 2404 (the Right to Know Act) is assigned to the Cybersecurity, Data Analytics, & IT Committee. The bill is on the committee’s agenda for March 26. As its name suggests, the Right to Know Act would provide Illinois residents with the right to know certain information regarding their personal information.
In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (entitled the Consumer Privacy Act) on February 22. That bill was assigned to the Judiciary – Civil Committee on March 16. The bill is listed on the agenda for the March 23 hearing date along with numerous other bills. HB 3910 is a modified version of the CCPA.
New Jersey is new to the active category this week. On March 15, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255). A recording of the hearing is available here.
House Bill 216 was introduced on February 2, 2021. Notably, the bill has attracted 18 Republican sponsors or co-sponsors. However, to date, it has not moved forward and is currently referred to the House committee on Technology and Research. The bill is similar to the CCPA.
HB 2865 was introduced on February 11, 2021. To date, there have been no hearings or votes taken on the bill. The bill is currently pending in the House Commerce Committee. The bill does not readily track the form or contents of either the CCPA or the Virginia and Washington bills.
SB21-190 was introduced on March 19, 2021. It was assigned to the Senate Committee on Business, Labor and Technology. You can read our analysis of the bill here.
SB 930 (the Maryland Online Consumer Protection Act) was introduced on February 10, 2021. No action has been taken to date. The bill is a modified version of the CCPA.
SD 1726 was filed on February 18, 2021. It does not appear that any action has been taken on the bill to date. The bill is a modified version of Washington’s People’s Privacy Act. A second bill, HD 3847, was filed in the state house.
Minnesota is interesting insofar as it was one of the first states to see legislation proposed this year (HF 36 proposed on January 7, 2021), but then lawmakers introduced a second bill (HF 1492 and its companion bill SF 1408) more than a month later. Neither bill has seen movement since being introduced.
HF 36 is a modified (and shortened) version of the CCPA and contains a private right of action. HF 1492 / SF 1408 are similar to the Washington and Virginia bills.
As shown on our tracker, New York legislators have proposed a number of consumer privacy bills in 2021. All of those bills currently sit in committee. In addition, Governor Cuomo’s privacy legislation (see page 148) is still active.
H 3063 was pre-filed on December 9, 2020 and referred to the Committee on Labor on January 12, 2021. It has not moved since. The bill is limited to providing rights around the collection and use of biometric information.
In Texas, Representative Capriglione filed six bills “related to increasing the protection of consumer data by the private sector.” One bill, HB 3741, is a data privacy omnibus bill. As introduced, the bill is perhaps best described as a heavily modified version of the CCPA, however, there are many aspects of the bill that make it unique, including its creation of three “categories” of data.
H.160 is still a short form bill (i.e., only one paragraph long). The bill has been referred to committee and no further action has been taken to date.
Lawmakers introduced HB 3159 on March 15, 2021. The bill was referred to the House Judiciary Committee. It is similar to the CCPA.
North Dakota’s HB 1330, Mississippi’s Senate Bill 2612, and Utah’s SB 200 have all died.