Keypoint: This week the Indiana Senate passed a bill, lawmakers in Alaska, Massachusetts, and Washington passed bills out of committee, new bills were introduced in West Virginia and Wisconsin, and there was movement on many VCDPA amendment bills.
Below is our fourth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide three reminders.
First, we will be hosting a webinar analyzing the proposed CCPA-like privacy bills on February 23, 2022. For more information, and to register, click here.
Second, we will be regularly updating our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.
Finally, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
- Other Bills
1. What’s New?
The big news this week was the Indiana Senate unanimously passing SB 358. As documented by Joe Duball from the IAPP, the bill underwent a significant change prior to passage and is now based on the Virginia Consumer Data Protection Act (VCDPA) model. The bill was referred to the House.
In other news, lawmakers voted three bills out of committee:
- On February 1, 2022, the Massachusetts Joint Advanced Information Technology, the Internet and Cybersecurity Committee voted an amended version of 142 / S. 46 out of committee.
- On February 3, 2022, the Washington House Committee on Civil Rights & Judiciary narrowly voted HB 1850 out of committee. The House Appropriations Committee held a hearing on February 5, 2022, but did not vote on the bill.
- On February 4, 2022, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The bill is scheduled for a hearing on February 7, 2022, with the House Judiciary Committee.
The outcome was different in Hawaii as HB2051 was deferred by the House Committee on Higher Education & Technology after a hearing on February 2, 2022.
We should see another active week with a number of hearings scheduled (see Section 2 below). Of note, the New York Senate Consumer Protection Committee will hold a hearing on the NY Privacy Act (S6701A) on February 8, 2022.
We also continue to see new bills introduced:
- In West Virginia, lawmakers introduced HB 4454. The bill was assigned to the House Judiciary Committee.
- In Wisconsin, lawmakers introduced AB 957. The bill was referred to the House Consumer Protection Committee and is scheduled for a hearing on February 16, 2022.
In addition, we had our first bill fail to pass this year as Mississippi SB 2330 died in committee.
Finally, there was a flurry of movement on VCDPA amendment bills. More details in Section 4 below.
2. Upcoming Hearings
February 7
- Public hearing on Alaska HB 159 in House Judiciary Committee
- Public hearing on Oregon HB 4017 (data brokers) in House Committee on Business and Labor
February 8
- Public hearing on the NY Privacy Act (S6701A) in Senate Consumer Protection Committee
February 9
- Public hearing on Maryland SB 335 (biometric information privacy bill) in Senate Finance Committee
February 16
February 28
- Public hearing on Nebraska LB 1188 in Banking, Commerce and Insurance Committee
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska
Alaska lawmakers are considering three bills – HB 222, HB 159 and SB 116. On February 4, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The bill is scheduled for a hearing on February 7, 2022 with the House Judiciary committee.
Arizona
Representative Domingo DeGrazia – author of HB 2865 in 2021 – reported that he will be filing at least one privacy bill in 2022.
Connecticut
Over the summer, Connecticut Senator James Maroney, who introduced SB 893 in 2021, convened a privacy working group comprised of various stakeholders to prepare the bill for the 2022 legislative. It is expected that an updated bill will be introduced when Connecticut’s legislature opens in February.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
Florida
Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed HB 9 on January 11, 2022. That bill was referred to the House Commerce Committee.
Georgia
Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
Hawaii
Hawaii lawmakers introduced four bills: HB 2051, HB2341, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022 and deferred the bill. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.
Indiana
The Indiana Senate passed SB 358 on February 1, 2022. The bill now moves to the House. Representative Hamilton introduced HB 1261 on January 10, 2022. The bill was referred to the House Committee on Commerce, Small Business and Economic Development.
Kentucky
Senator Westerfield introduced SB 15 on January 13, 2022. The bill was referred to the Committee on Committees.
Maryland
Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On January 26, 2022, the Senate Finance Committee held a hearing on the bill.
Massachusetts
The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. Lawmakers also filed H.136.
Minnesota
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill when the Minnesota legislature opens in late January.
Mississippi
SB 2330 died in committee.
Nebraska
Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act. The bill is scheduled for a hearing on February 28, 2022.
New Jersey
New Jersey lawmakers filed three bills: S332, A505, and A1971.
New York
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. That bill passed out of the Senate Consumer Protection Committee in 2021 but did not advance further. The bill has been referred back to the Consumer Protection Committee and is scheduled for a hearing on February 8, 2022.
North Carolina
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
Ohio
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. From September to December, the Committee held four hearings on the bill but has yet to vote on it. In December, it was reported that the bill had been held back from a Committee vote to allow for further consideration. The bill carried over into 2022.
Oklahoma
Oklahoma lawmakers will consider two bills filed by Representative Collin Walke when the legislature opens in February. HB 1602, which passed the Oklahoma House last year but stalled in the Senate, will carry over. Representative Walke pre-filed a second bill – HB 2969 – in September. Finally, Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act.
Pennsylvania
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee.
Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.
The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.
South Carolina
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.
Tennessee
Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced HB 1197.
Vermont
Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.
Washington
Washington lawmakers are considering a number of privacy bills in 2022.
Senator Carlyle’s Washington Privacy Act (SB 5062) carried over from last year. In 2021, that bill passed the Senate but failed in the House. The bill is assigned to the Senate Rules Committee.
Senator Carlyle also introduced SB 5813, which addresses children and adolescent information, data brokers, and opt out signals. On January 20, 2022, the Washington Senate Committee on Environment, Energy & Technology held a hearing on the bill.
Representative Kloba’s People’s Privacy Act (HB 1433) also carried over from 2021. Representative Kloba is working on an amended bill.
Finally, Representatives Vandana Slatter and April Berg introduced the Washington Foundational Data Privacy Act (HB 1850). On February 3, the Washington House Committee on Civil Rights & Judiciary narrowly voted HB 1850 out of committee. The House Appropriations Committee held a hearing on February 5, 2022, but did not vote on the bill.
West Virginia
West Virginia, lawmakers introduced HB 4454. The bill was assigned to the House Judiciary Committee.
Wisconsin
Lawmakers introduced AB 957. The bill was referred to the House Consumer Protection Committee and is scheduled for a hearing on February 16, 2022.
4. VCDPA Amendments
We saw a flurry of activity last week with the eight VCDPA amendment bills. Perhaps most notable was an alignment on the language for the right to delete exemption and a change in HB 714, which sought to modify the right to cure. The substituted version of HB 714 (which advanced out of a subcommittee) no longer grants the Attorney General’s office with discretion to determine whether a cure is possible or to seek actual damages. The Senate version has yet to be modified.
We provide a full update and analysis on the VCDPA amendment bills here.
5. Biometric Privacy Bills
Six states are considering BIPA-like biometric information privacy bills:
Kentucky
HB32 was introduced on January 4, 2022 and referred to the Committee on Committees.
Maine
Lawmakers in Maine introduced LD 1945. The bill was referred to the Judiciary Committee.
Maryland
Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House Economic Matters Committee held a hearing on February 2, 2022. No vote was taken. The Senate bill was assigned to the Senate Finance Committee and scheduled for a hearing on February 9, 2022.
Massachusetts
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure.
New York
New York lawmakers are considering A27 and S1933. A27 was referred to the Assembly Consumer Affairs and Protection Committee. S1933 was referred to the Consumer Protection Committee.
West Virginia
HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.
6. Data Broker Bills
Four states are considering bills to regulate data brokers:
Delaware
Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.
Massachusetts
Massachusetts lawmakers are considering S.50. The bill was referred to the Joint Advanced Information Technology, the Internet and Cybersecurity Committee.
Oregon
Lawmakers in Oregon are considering HB 4017. The bill was referred to the House Committee on Business and Labor. A hearing has been scheduled for February 7, 2022.
Washington
As noted in Part 2, Senator Carlyle’s SB 5813 seeks to regulate data brokers.
7. Other Bills
Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.
In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 (HB3009) and a computer algorithm regulation bill (HB 3011).
West Virginia lawmakers are considering HB 2148, which seeks to impose a general data mining service tax.