
Keypoint: This week lawmakers introduced new bills in Georgia, Hawaii and Oklahoma, the Indiana Senate passed a bill out of committee, and hearings were held on bills in Alaska, Maryland, and Washington.
Below is our third weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide two reminders.
First, we will be regularly updating our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
- Other Bills
1. What’s New?
We continue to see new CCPA-like privacy bills with lawmakers in three states introducing bills last week:
- Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
- Hawaii lawmakers introduced three bills: HB 2051, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means.
- Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act.
In total, there are now twenty states, plus the District of Columbia, considering CCPA-like consumer privacy legislation. We expect lawmakers in at least three other states to propose bills in the coming weeks.
Lawmakers also conducted hearings on four bills last week:
- On January 25, 2022, the Washington House Committee on Civil Rights & Judiciary held a hearing on HB 1850 – the Washington Foundational Data Privacy Act. The committee also considered the bill during executive session on January 28, 2022. The bill is set for another executive session on February 2, 2022.
- On January 26, 2022, the Maryland Senate Finance Committee held a hearing on SB 11.
- On January 26 and 28, 2022, the Alaska House Labor & Finance Committee held hearings on HB 159. The committee is set for another hearing on January 31, 2022.
- On January 27, 2022, the Indiana Senate Committee on Commerce and Technology held a hearing on SB 358 and voted 10-0 to vote the bill out of committee. Prior to doing so, the as-introduced bill was amended and replaced with a new bill based on the VCDPA.
In related news, Washington Senator Reuven Carlyle – author of the Washington Privacy Act – announced that he will not seek re-election to the senate in 2022.
In Virginia, there was a little bit of movement on the Virginia Consumer Data Protection Act amendment bills. On January 27, a House subcommittee of the General Laws Committee voted 8-0 to recommend reporting HB 381. That bill seeks to modify the right to delete.
In addition to CCPA-like privacy bills, the list of states considering biometric privacy bills continues to grow with lawmakers in Maine introducing LD 1945. There are now six states considering such bills.
We also saw developments with data broker bills. On January 25, 2022, the Delaware House Technology & Telecommunications Committee held a public hearing on HB 262. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee. Also, lawmakers in Oregon introduced HB 4017. There are now four states considering such bills.
2. Upcoming Hearings
January 31
- Public hearing on Alaska HB 159 in House Labor & Commerce Committee
February 2
- Public hearing on Maryland HB 259 (biometric information privacy bill) in House Economic Matters Committee
- Executive session on Washington HB 1850 in House Committee on Civil Rights & Judiciary
- Public hearing on Alaska HB 159 in House Judiciary Committee (pending referral)
February 9
- Public hearing on Maryland SB 335 (biometric information privacy bill) in Senate Finance Committee
February 28
- Public hearing on Nebraska LB 1188 in Banking, Commerce and Insurance Committee
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska
Alaska lawmakers are considering three bills – HB 222, HB 159 and SB 116. On January 26 and 28, 2022, the Alaska House Labor & Finance Committee held hearings on HB 159. The committee is set for another hearing on January 31, 2022.
Arizona
Representative Domingo DeGrazia – author of HB 2865 in 2021 – reported that he will be filing at least one privacy bill in 2022.
Connecticut
Over the summer, Connecticut Senator James Maroney, who introduced SB 893 in 2021, convened a privacy working group comprised of various stakeholders to prepare the bill for the 2022 legislative. It is expected that an updated bill will be introduced when Connecticut’s legislature opens in February.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
Florida
Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed HB 9 on January 11, 2022. That bill was referred to the House Commerce Committee.
Georgia
Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
Hawaii
Hawaii lawmakers have introduced three bills: HB 2051, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means.
Indiana
Representative Hamilton introduced HB 1261 on January 10, 2022. The bill was referred to the House Committee on Commerce, Small Business and Economic Development.
Senator Brown introduced SB 358 on January 12, 2022. The Senate Committee on Commerce and Technology voted the bill out of committee on January 27, 2022.
Kentucky
Senator Westerfield introduced SB 15 on January 13, 2022. The bill was referred to the Committee on Committees.
Maryland
Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On January 26, 2022, the Senate Finance Committee held a hearing on SB 11.
Massachusetts
Massachusetts lawmakers continue to consider the Massachusetts Information Privacy Act (H.136, H.142 & S.46). Those bills were referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. The Committee held a hearing on October 13, 2021, but has not scheduled any additional hearings to date.
Minnesota
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill when the Minnesota legislature opens in late January.
Mississippi
Senator Angela Turner-Ford reintroduced the Mississippi Consumer Data Privacy Act (SB 2330) on January 17, 2022. The bill was referred to the Senate Judiciary, Division A committee.
Nebraska
Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act. The bill is scheduled for a hearing on February 28, 2022.
New Jersey
New Jersey lawmakers filed three bills: S332, A505, and A1971.
New York
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. That bill passed out of the Senate Consumer Protection Committee in 2021 but did not advance further. The bill has been referred back to the Consumer Protection Committee.
North Carolina
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
Ohio
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. From September to December, the Committee held four hearings on the bill but has yet to vote on it. In December, it was reported that the bill had been held back from a Committee vote to allow for further consideration. The bill carried over into 2022.
Oklahoma
Oklahoma lawmakers will consider two bills filed by Representative Collin Walke when the legislature opens in February. HB 1602, which passed the Oklahoma House last year but stalled in the Senate, will carry over. Representative Walke pre-filed a second bill – HB 2969 – in September. Finally, Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act.
Pennsylvania
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee.
Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.
The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.
South Carolina
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.
Tennessee
Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced HB 1197.
Vermont
Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.
Washington
Washington lawmakers are considering a number of privacy bills in 2022.
Senator Carlyle’s Washington Privacy Act (SB 5062) carried over from last year. In 2021, that bill passed the Senate but failed in the House. The bill is assigned to the Senate Rules Committee.
Senator Carlyle also introduced SB 5813, which addresses children and adolescent information, data brokers, and opt out signals. On January 20, 2022, the Washington Senate Committee on Environment, Energy & Technology held a hearing on the bill.
Representative Kloba’s People’s Privacy Act (HB 1433) also carried over from 2021. Representative Kloba is working on an amended bill.
Finally, Representatives Vandana Slatter and April Berg introduced the Washington Foundational Data Privacy Act (HB 1850). The bill is similar to the Colorado and Virginia laws, but it contains an annual registration requirement, would create the Washington State Consumer Data Privacy Commission (similar to the California Privacy Protection Agency), and contains a private right of action. On January 25, the Washington House Committee on Civil Rights & Judiciary held a hearing on HB 1850. The committee also considered the bill during executive session on January 28, 2022. The bill is set for another executive session on February 2, 2022.
4. VCDPA Amendments
Virginia lawmakers are considering eight bills that would amend the VCDPA:
House Bill 381, Senate Bill 393, and Senate Bill 584 would add a new exemption to the VCDPA’s right to delete. On January 27, 2022, a subcommittee of the House General Laws Committee voted 8-0 to recommend reporting HB 381.
House Bill 552 and Senate Bill 516 would expand the VCDPA’s definition of “nonprofit organization” to include “any organization exempt from taxation under § 501 (c)(4) of the Internal Revenue Code that is identified in § 52-41.”
House Bill 714 and Senate Bill 534 would modify the VCDPA’s enforcement provisions and definition of “nonprofit organization.”
HB 1259 would amend and restrict the definition of “sensitive data.”
For more information, see our articles here and here.
5. Biometric Privacy Bills
Six states are considering BIPA-like biometric information privacy bills:
Kentucky
HB32 was introduced on January 4, 2022.
Maine
Lawmakers in Maine introduced a biometric information privacy bill (LD 1945). The bill was referred to the Judiciary Committee.
Maryland
Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House bill is with the Economic Matters Committee and scheduled for a hearing on February 2, 2022. The Senate bill was assigned to the Senate Finance Committee and scheduled for a hearing on February 9, 2022.
Massachusetts
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure.
New York
New York lawmakers are considering A 27. The bill was referred to the Assembly Consumer Affairs and Protection Committee.
West Virginia
HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.
6. Data Broker Bills
Four states are considering bills to regulate data brokers:
Delaware
Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.
Massachusetts
Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee.
Oregon
Lawmakers in Oregon are considering HB 4017.
Washington
As noted in Part 2, Senator Carlyle’s SB 5813 seeks to regulate data brokers.
7. Other Bills
Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.
In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 (HB3009) and a computer algorithm regulation bill (HB 3011).
West Virginia lawmakers are considering HB 2148, which seeks to impose a general data mining service tax.