Keypoint: This week lawmakers introduced new bills in Mississippi, Nebraska, and Pennsylvania, held hearings in Alaska and Washington, and scheduled hearings for the coming week in Alaska, Delaware, Indiana, Maryland, and Washington.
Below is our second weekly update on proposed state privacy laws. As with past updates, we track the status of proposed CCPA-like privacy legislation. In addition, starting this week we have expanded the update to track upcoming hearings, VCDPA amendments, biometric privacy bills, data broker bills, and other bills of note. We even added a table of contents! We hope you enjoy the additional content.
Before we get to our update, we wanted to provide two reminders.
First, we will be regularly updating our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like bills. We encourage you to bookmark the page for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter. Last week, we provided a mid-week update on a new VCDPA amendment.
Table of Contents
- What’s New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
- Other Bills
1. What’s New?
Lawmakers introduced three new CCPA-like privacy bills last week:
- Mississippi Senator Angela Turner-Ford reintroduced the Mississippi Consumer Data Privacy Act (SB 2330) on January 17, 2022. The bill was referred to the Senate Judiciary, Division A committee.
- Nebraska Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act.
- In Pennsylvania, lawmakers introduced a third bill – HB 2257 – on January 20, 2022. The bill was referred to the House Consumer Affairs Committee, which is the same committee considering the other two Pennsylvania bills.
In total, there are now twenty-two states, plus the District of Columbia, considering CCPA-like broad consumer privacy legislation. We also expect lawmakers in at least three other states to propose bills in the coming weeks.
Lawmakers also conducted hearings on two existing bills last week:
- On January 20, 2022, the Washington Senate Committee on Environment, Energy & Technology held a hearing on SB 5813. The hearing lasted approximately 45 minutes during which the committee received public testimony from numerous individuals. The committee did not vote on the bill.
- On January 21, 2022, the Alaska House Labor & Commerce Committee held a hearing on HB 159. The committee heard invited testimony from Consumer Reports’ Maureen Mahoney and Michael Garvey from ACLU of Alaska. The committee did not vote on the bill. A second hearing is scheduled for January 26, 2022.
- In Indiana, the hearing that was scheduled on SB 358 for January 20, 2022 was moved to January 27, 2022.
As discussed in Part 2 below, we expect another busy week with six hearings scheduled.
In Virginia, lawmakers proposed an eighth bill to amend the Virginia Consumer Data Protection Act.
Finally, in our “other bills” category, West Virginia Representative Thompson introduced HB 2148, which seeks to impose a general data mining service tax on commercial data operators.
2. Upcoming Hearings
- Public hearing on Washington HB 1850 in House Committee on Civil Rights & Judiciary
- Public hearing on Delaware HB 262 (data brokers) in House Technology & Telecommunications Committee
- Public hearing on Alaska HB 159 in House Labor & Commerce Committee
- Public hearing on Maryland SB 11 in Senate Finance Committee
- Public hearing on Indiana SB 358 in Senate Commerce and Technology Committee
- Washington HB 1850 is scheduled for executive session in House Labor & Commerce Committee
- Public hearing on Maryland HB 259 (biometric information privacy bill) in House Economic Matters Committee
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska lawmakers are considering three bills – HB 222, HB 159 and SB 116. On January 21, 2022, the Alaska House Labor & Commerce Committee held a hearing on HB 159. The committee heard invited testimony from Consumer Reports’ Maureen Mahoney and Michael Garvey from ACLU of Alaska. A second hearing is scheduled for January 26, 2022.
Representative Domingo DeGrazia – author of HB 2865 in 2021 – reported that he will be filing at least one privacy bill in 2022.
Over the summer, Connecticut Senator James Maroney, who introduced SB 893 in 2021, convened a privacy working group comprised of various stakeholders to prepare the bill for the 2022 legislative. It is expected that an updated bill will be introduced when Connecticut’s legislature opens in February.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed HB 9 on January 11, 2022. That bill was referred to the House Commerce Committee.
Representative Hamilton introduced HB 1261 on January 10, 2022. The bill was referred to the House Committee on Commerce, Small Business and Economic Development.
Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. The bill was referred to the Senate Finance Committee and is scheduled for a hearing on January 26, 2022.
Massachusetts lawmakers continue to consider the Massachusetts Information Privacy Act (H.136, H.142 & S.46). Those bills were referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. The Committee held a hearing on October 13, 2021, but has not scheduled any additional hearings to date.
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill when the Minnesota legislature opens in late January.
Senator Angela Turner-Ford reintroduced the Mississippi Consumer Data Privacy Act (SB 2330) on January 17, 2022. The bill was referred to the Senate Judiciary, Division A committee.
Nebraska Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act.
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. That bill passed out of the Senate Consumer Protection Committee in 2021 but did not advance further. The bill has been referred back to the Consumer Protection Committee.
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. From September to December, the Committee held four hearings on the bill but has yet to vote on it. In December, it was reported that the bill had been held back from a Committee vote to allow for further consideration. The bill carried over into 2022.
Oklahoma lawmakers will consider two bills filed by Representative Collin Walke when the legislature opens in February. HB 1602, which passed the Oklahoma House last year but stalled in the Senate, will carry over. Representative Walke pre-filed a second bill – HB 2969 – in September.
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee.
Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.
The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill will carried over to the 2022 session.
Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced HB 1197.
Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.
Washington lawmakers are considering a number of privacy bills in 2022.
Senator Carlyle also introduced SB 5813, which addresses children and adolescent information, data brokers, and opt out signals. On January 20, 2022, the Washington Senate Committee on Environment, Energy & Technology held a hearing on the bill.
Representative Kloba’s People’s Privacy Act (HB 1433) also carried over from 2021. Representative Kloba is working on an amended bill.
Finally, Representatives Vandana Slatter and April Berg introduced the Washington Foundational Data Privacy Act (HB 1850). The bill is similar to the Colorado and Virginia laws, but it contains an annual registration requirement, would create the Washington State Consumer Data Privacy Commission (similar to the California Privacy Protection Agency), and contains a private right of action. That bill was referred to the Civil Rights & Judiciary Committee. It is scheduled for a public hearing in the House Committee on Civil Rights & Judiciary on January 25, 2022 and is scheduled for executive session on January 28, 2022.
4. VCDPA Amendments
Virginia lawmakers are considering eight bills that would amend the VCDPA:
House Bill 552 and Senate Bill 516 would expand the VCDPA’s definition of “nonprofit organization” to include “any organization exempt from taxation under § 501 (c)(4) of the Internal Revenue Code that is identified in § 52-41.”
HB 1259 would amend and restrict the definition of “sensitive data.”
5. Biometric Privacy Bills
Five states are considering BIPA-like biometric information privacy bills:
HB32 was introduced on January 4, 2022.
Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House bill is with the Economic Matters Committee and scheduled for a hearing on February 2, 2022. The Senate bill was assigned to the Senate Finance Committee.
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure.
New York lawmakers are considering A 27. The bill was referred to the Assembly Consumer Affairs and Protection Committee.
HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.
6. Data Broker Bills
Three states are considering bills to regulate data brokers:
Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee.
As noted in Part 2, Senator Carlyle’s SB 5813 seeks to regulate data brokers.
7. Other Bills
Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.
West Virginia lawmakers are considering HB 2148, which seeks to impose a general data mining service tax.