Keypoint: This week Indiana’s bill continued to advance in the House (after previously passing the Senate), lawmakers voted bills out of committee in Iowa and Oklahoma, and new bills were introduced in Maine, Utah and Wisconsin.
Below is our sixth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide three reminders.
First, on February 23, 2022, we will be hosting a webinar to analyze the proposed CCPA-like privacy bills. For more information, and to register, click here.
Second, we regularly update our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.
Finally, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
- Other Bills
1. What’s New?
This week lawmakers voted three bills out of committee:
- On February 15, 2022, the Iowa House Information Technology Committee voted 15-0 for favorable recommendation of HSB 674.
- On February 16, 2022, Representative Collin Walke’s HB 2969 passed the House Technology. Prior to passing, a committee amendment was filed, striking the prior version of the bill and replacing it with a version nearly identical to HB 1602. According to Representative Walke, the difference between the two bills is that HB 2969 has a higher monetary threshold for applicability (annual gross revenues of $15 million instead of $10 million).
- On February 17, 2022, the Indiana House Commerce, Small Business and Economic Development Committee passed SB 358.
Lawmakers also held hearings on bills in Wisconsin and Kentucky. Next week there are hearings scheduled on Wisconsin’s AB 957 and Maine’s LD 1945 (biometric privacy bill). It is possible that more hearings will be held next week as many are being scheduled on short notice.
We also continue to see new bills introduced:
- In Maine, Senator Rafferty introduced LD 1982 on February 16, 2022. The bill was referred to the Innovation, Development, Economic Advancement and Business Committee.
- In Utah, Senator Cullimore introduced SB 227 on February 18, 2022. The bill was referred to the Senate Revenue and Taxation Committee. The Utah legislature closes on March 4, 2022.
- In Wisconsin, lawmakers introduced AB 1050 on February 17, 2022. This is the fourth privacy bill introduced in Wisconsin this year. The bill appears to be a companion bill to SB 977.
In Washington, it appears that lawmakers may have again failed to pass privacy legislation. According to the legislative calendar, the last day to pass bills out of their house of origin was February 15, 2022. None of the four bills introduced or carried over this year (SB 5062, SB 5813, HB 1433, and HB 1850) met that deadline. In addition, on February 17, Senator Carlyle’s Washington Privacy Act (SB 5062) was placed on the Senate Rules “X” file. We will continue to monitor the bills through the March 10, 2022 adjournment date in case there are any developments.
In Virginia, there was more movement on VCDPA amendment bills with a number of the bills passing through chamber votes. More details in Section 4 below.
Finally, in biometric privacy bill news, HB 2716 was introduced in Missouri.
2. Upcoming Hearings
February 22
- Executive session hearing on Wisconsin AB 957
- Public hearing on Maine LD 1945 (biometric privacy bill) in Judiciary Committee
February 28
- Public hearing on Nebraska LB 1188 in Banking, Commerce and Insurance Committee
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska
Alaska lawmakers are considering three bills – HB 222, HB 159 and SB 116. On February 4, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The House Judiciary Committee held a hearing on February 7, 2022. No vote was taken.
Arizona
Representative DeGrazia filed HB2790.
Connecticut
Connecticut Senator James Maroney, who introduced SB 893 in 2021, has scheduled a hearing on a revised bill for February 22, 2022. The revised bill has not yet been published.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
Florida
Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed HB 9 on January 11, 2022. On February 10, 2022, the Florida House Commerce Committee voted HB 9 out of committee. On February 14, 2022, the bill was referred to the Judiciary Committee. The Florida legislature closes on March 11, 2022.
Georgia
Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
Hawaii
Hawaii lawmakers introduced four bills: HB 2051, HB2341, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022 and deferred the bill. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.
Indiana
The Indiana Senate passed SB 358 on February 1, 2022. On February 17, 2022, the Indiana House Commerce, Small Business and Economic Development Committee passed the bill.
Iowa
Lawmakers introduced HSB 674 and SF2208. On February 15, 2022, the Iowa House Information Technology Committee voted 15-0 for favorable recommendation of HSB 674. SF2208 was referred to a Commerce Committee subcommittee.
Kentucky
Senator Westerfield introduced SB 15 on January 13, 2022. On February 15, 2022, the Kentucky Senate Standing Committee on Economic Development, Tourism and Labor held an informational hearing on the bill.
Maryland
Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On January 26, 2022, the Senate Finance Committee held a hearing on the bill.
Massachusetts
The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. The bill is now filed under S.2687 (the Massachusetts Information Privacy and Security Act). On February 14, 2022, the bill was referred to the Senate Ways and Means Committee.
Minnesota
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill.
Mississippi
SB 2330 died in committee.
Nebraska
Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act. The bill is scheduled for a hearing on February 28, 2022.
New Jersey
New Jersey lawmakers filed three bills: S332, A505, and A1971.
New York
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. On February 8, 2022, the New York Senate Consumer Affairs Committee voted S6701A out of committee. The bill was reported and committed to the Internet and Technology Committee.
North Carolina
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
Ohio
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. On February 9, 2022, the Ohio House Government Oversight Committee voted HB 376 out of committee. On February 16, 2022, the status of the bill was changed to “informally passed.” According to the IAPP’s Joe Duball, this means that the bill is being held in place while it is worked on.
Oklahoma
Oklahoma lawmakers are considering three bills. HB 1602, which passed the Oklahoma House last year but stalled in the Senate, carried over to 2022. Representative Walke also a second bill – HB 2969. Finally, Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act.
On February 16, 2022, Representative Collin Walke’s HB 2969 passed the House Technology. Prior to passing, a committee amendment was filed, striking the prior version of the bill and replacing it with a version nearly identical to HB 1602. According to Representative Walke, the difference between the two bills is that HB 2969 has a higher monetary threshold for applicability (annual gross revenues of $15 million instead of $10 million).
Pennsylvania
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee.
Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.
The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.
Rhode Island
Lawmakers introduced H7400 on February 9, 2022. The bill was referred to the House Innovation, Internet and Technology Committee.
South Carolina
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.
Tennessee
Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced HB 1197.
Utah
Senator Cullimore introduced SB 227 on February 18, 2022. The bill was referred to the Senate Revenue and Taxation Committee. The Utah legislature closes on March 4, 2022.
Vermont
Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.
Washington
It appears that Washington lawmakers may have once again failed to pass privacy legislation. According to the legislative calendar, the last day to pass bills out of their house of origin was February 15. (See also here.) None of the four bills introduced or carried over this year (SB 5062, SB 5813, HB 1433, and HB 1850) met that deadline. In addition, on February 17, Senator Carlyle’s Washington Privacy Act (SB 5062) was placed on the Senate Rules “X” file.
West Virginia
West Virginia, lawmakers introduced HB 4454. The bill was assigned to the House Judiciary Committee.
Wisconsin
Wisconsin lawmakers are considering four bills.
AB 957 and SB 957 are companion bills. On February 16, 2022, the Wisconsin House Committee on Consumer Protection held a hearing on AB 957. SB 957 was referred to the Committee on Government Operations, Legal Review and Consumer Protection.
Wisconsin lawmakers also introduced companion bills SB 977 on February 9, 2022 and AB 1050 on February 17, 2022. SB 977 was referred to the Committee on Government Operations, Legal Review and Consumer Protection. AB 1050 was referred to the Committee on Consumer Protection.
4. VCDPA Amendments
As the Virginia legislature’s March 12 adjournment date inches closer, it appears we could see VCDPA amendments pass in the coming days. Here are some highlights:
- The deadline for each house to work on its own bills passed on February 15. Five amendment bills met that deadline.
- The remaining bills seek to (1) add a new exemption to the right to delete, (2) repeal the Consumer Privacy Fund, (3) modify the definition of nonprofit organization, and (4) change the VCDPA’s treatment of sensitive data.
- HB 1259, which seeks to amend the VCDPA’s treatment of sensitive data, was amended this week and subsequently passed by the House.
We provide a full update on bills here.
5. Biometric Privacy Bills
Seven states are considering BIPA-like biometric information privacy bills:
Kentucky
HB32 was introduced on January 4, 2022 and referred to the Committee on Committees.
Maine
Lawmakers in Maine introduced a biometric information privacy bill (LD 1945). The bill was referred to the Judiciary Committee. A hearing has been scheduled for February 22, 2022.
Maryland
Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House Economic Matters Committee held a hearing on February 2, 2022. The Senate Finance Committee held a hearing on February 9, 2022. No votes were taken.
Massachusetts
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure. On February 14, 2022, the bill was incorporated into S.2687.
Missouri
HB 2716 was introduced on February 16, 2022.
New York
New York lawmakers are considering A27 and S1933. A27 was referred to the Assembly Consumer Affairs and Protection Committee. S1933 was referred to the Consumer Protection Committee.
West Virginia
HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.
6. Data Broker Bills
Four states are considering bills to regulate data brokers:
Delaware
Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.
Massachusetts
Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee. The bill was incorporated into S.2687.
Oregon
Lawmakers in Oregon are considering HB 4017. The bill was passed out of the House Committee on Business and Labor on February 11 and referred to the Joint Ways and Means Committee.
Washington
As noted in Part 2, Senator Carlyle’s SB 5813 sought to regulate data brokers. That bill appears to have died.
7. Other Bills
Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.
In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 (HB3009) and a computer algorithm regulation bill (HB 3011). HB 3009 was referred to the House Technology Committee and a hearing scheduled for February 18. HB 3011 was referred to the Rules Committee.
West Virginia lawmakers are considering HB 2148, which seeks to impose a general data mining service tax.