Keypoint: This week the Utah Governor signed the Utah Consumer Privacy Act, the Oklahoma House passed a bill, and a committee hearing was held in Rhode Island.

Below is our eleventh weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide two reminders.

First, we regularly update our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Table of Contents

  1. What’s New?
  2. Upcoming Hearings
  3. CCPA-Like Privacy Bills
  4. VCDPA Amendments
  5. Biometric Privacy Bills
  6. Data Broker Bills

1. What’s New?

There were two lead stories this week.

On March 23, 2022, the Oklahoma House voted to pass Representative Collin Walke’s HB 2969. If passed, the bill would require businesses to obtain consumer consent for the collection of personal information. The Oklahoma House passed a similar bill last year but it failed to make it out of the Senate Judiciary Committee. HB 2969 has not yet been referred to a Senate committee. According to the Oklahoma legislative calendar, April 14 is the deadline for HB 2969 to make it out of a Senate committee.

In Utah, Governor Spencer Cox signed the Utah Consumer Privacy Act (UCPA) (SB 227) on March 24, 2022, officially making Utah the fourth state to pass consumer data privacy legislation. Do you want to know more about the UCPA? Click here to access our 18 minute on-demand webinar. We also updated our State Privacy Law Database with the UCPA.

In addition, on March 22, 2022, the Rhode Island House Innovation, Internet & Technology Committee held a hearing on HB 7400. The committee recommended that the measure be held for further study. Rhode Island lawmakers will hold a hearing on HB 7917 on March 31, 2022.

2. Upcoming Hearings

March 30, 2022

Public hearing on Maryland’s SB11 (one year work study bill) in House Economic Matters Committee

March 31, 2022

Public hearing on Rhode Island’s HB 7917 in House State Government & Elections Committee

April 5, 2022

Public hearing on California’s SB 1189 (biometric privacy)

Please note that many hearings are scheduled on short notice, and it is possible that more hearings could be noticed and held during this time period.

3. CCPA-Like Privacy Bills

Below is the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.

Alaska

Alaska lawmakers are considering three bills – HB 222HB 159 and SB 116. On February 4, 2022, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The House Judiciary Committee held hearings on February 7, 2022 and March 18, 2022.

Arizona

Representative DeGrazia filed HB2790.

Connecticut

Connecticut Senator James Maroney introduced SB 6 on February 23, 2022. On March 15, 2022, the Joint General Law Committee voted 14-4 to advance the bill. On March 25, 2022, the bill was referred to the Office of Legislative Research and Office of Fiscal Analysis.

District of Columbia

Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.

Florida

The Florida legislature closed on March 11, 2022, without passing a bill.

Georgia

Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology. The Georgia legislature adjourns March 31, 2022.

Hawaii

Hawaii lawmakers introduced four bills: HB 2051, HB2341, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022 and deferred the bill. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.

Indiana

The Indiana legislature closed on March 14, 2022, without passing a bill.

Iowa

Lawmakers introduced HSB 674 and SF2208. The Iowa House passed House File 2506 on March 14, 2022. The bill moved to the Iowa Senate and was assigned to a subcommittee of the Judiciary Committee. However, according to the Iowa legislative session timetable, March 18, 2022, was the final date for House bills to be reported out of Senate committees, which did not happen. The Iowa legislature adjourns April 19, 2022.

Kentucky

Senator Westerfield introduced SB 15 on January 13, 2022. On February 15, 2022, the Kentucky Senate Standing Committee on Economic Development, Tourism and Labor held an informational hearing on the bill.

On February 24, 2022, lawmakers introduced HB 586. The bill was referred to the Committee on Committees.

The Kentucky legislature adjourns April 15, 2022.

Maine

The Maine legislature website for LD 1982 reports that the bill is dead.

Maryland

Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On March 11, 2022, the Senate Finance Committee converted the bill to establish a one-year work group study. The converted bill unanimously passed the Senate on March 17, 2022. A House committee hearing is set for March 30, 2022. Maryland’s legislature adjourns April 11, 2022.

Massachusetts

The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. The bill is now filed under S.2687 and H.4514 (the Massachusetts Information Privacy and Security Act). On February 14, 2022, S.2687 was referred to the Senate Ways and Means Committee. On March 3, 2022, H.4514 was referred to the Joint Healthcare Finance Committee.

Minnesota

Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins has not introduced a bill to date. According to the Minnesota legislature’s committee deadlines webpage, the deadline for bills to get out of committee in their house of origin passed on March 25, 2022.

Mississippi

SB 2330 died in committee.

Nebraska

Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission’s model act. The Banking, Commerce and Insurance Committee held a hearing on February 28, 2022. No vote was taken. The Nebraska legislature adjourns April 20, 2022.

New Jersey

New Jersey lawmakers filed three bills: S332A505, and A1971.

New York

As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. On February 8, 2022, the New York Senate Consumer Affairs Committee voted S6701A out of committee. The bill was reported and committed to the Internet and Technology Committee.

North Carolina

In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.

Ohio

The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. On February 9, 2022, the Ohio House Government Oversight Committee voted the bill out of committee. On February 16, 2022, the status of the bill was changed to “informally passed.” On February 22, 2022, the bill was re-referred to the Rules and Reference Committee.

Oklahoma

On March 23, 2022, the Oklahoma House voted to pass Representative Collin Walke’s HB 2969. If passed, the bill would require businesses to obtain consumer consent for the collection of personal information. The Oklahoma House passed a similar bill last year but it failed to make it out of the Senate Judiciary Committee. HB 2969 has not yet been referred to a Senate committee. According to the Oklahoma legislative calendar, April 14 is the deadline for HB 2969 to make it out of a Senate committee.

According to Representative Walke, HB 1602, which passed the Oklahoma House last year but stalled in the Senate and carried over to 2022, is now dead. In addition, Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act. It appears that bill also is dead.

Pennsylvania

Pennsylvania lawmakers are considering three bills.

HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.

In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee.

Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.

The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.

Rhode Island

On March 22, 2022, the Rhode Island House Innovation, Internet & Technology Committee held a hearing on HB 7400. The committee recommended that the measure be held for further study.

Representative McNamara introduced HB7917 – the Rhode Island Information Privacy Act – on March 7, 2022. The bill was referred to the House Government & Elections Committee, which has scheduled a hearing for March 31, 2022.

South Carolina

Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.

Tennessee

On March 15, 2022, the Senate Commerce & Labor Committee voted 6-3 against advancing SB 1554 out of committee. The following day, the Banking and Consumer Affairs subcommittee returned HB 1467 to the clerk’s desk. According to the Tennessee legislature’s “How a Bill Becomes a Law” and House Rule 83(2), the bill sponsor would have to appeal to the House Speaker to re-refer the bill. The Tennessee legislature adjourns April 21, 2022.

Utah

Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (SB 227) on March 24, 2022, officially making Utah the fourth state to pass consumer data privacy legislation. Click here to access our 18 minute on-demand webinar on the UCPA.

Vermont

On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development. The House Committee on Commerce and Economic Development held a hearing on H.570 on March 16, 2022. Draft language was submitted as part of the meeting materials.

Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.

Washington

The Washington legislature closed on March 10, 2022, without passing a bill.

West Virginia

The West Virginia legislature closed on March 12, 2022, without passing a bill.

Wisconsin

The Wisconsin legislature closed on March 10, 2022, without passing a bill.

4. VCDPA Amendments

There were no new developments this week with respect to the VCDPA amendment bills. As we reported last week, Virginia lawmakers passed four bills to amend the VCDPA prior to the March 12, 2022 adjournment date. The Governor has until April 11, 2022 to act on the bills.

5. Biometric Privacy Bills

The following states are considering BIPA-like biometric information privacy bills:

California

SB 1189 was introduced on February 18, 2022. It was referred to the Committees on Judiciary and Appropriation. A hearing has been set for April 5, 2022.

Kentucky

HB32 was introduced on January 4, 2022. The bill was withdrawn on February 28, 2022.

Maine

Lawmakers in Maine introduced LD 1945. The Judiciary Committee held a hearing on February 22, 2022 and a work session on March 2, 2022. The bill was tabled on March 23, 2022.

Maryland

The Maryland House passed HB 259 – the Biometric Data Privacy Act – on March 19, 2022. The bill is now with the Senate Finance committee. A companion bill, SB 335, was filed in the Senate. The Senate Finance Committee held a hearing on SB 335 on February 9, 2022. No vote was taken. The Maryland legislature adjourns April 11, 2022.

Massachusetts

Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure. On February 14, 2022, the bill was incorporated into S.2687.

Missouri

HB 2716 was introduced on February 16, 2022.

New York

New York lawmakers are considering A27 and S1933. A27 was referred to the Assembly Consumer Affairs and Protection Committee. S1933 was referred to the Consumer Protection Committee.

West Virginia

The West Virginia legislature closed on March 12, 2022, without passing HB2064.

6. Data Broker Bills

Two states are considering bills to regulate data brokers:

Delaware

Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.

Massachusetts

Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee. The bill was incorporated into S.2687.

Oregon

The Oregon legislature closed on March 7, 2022, without lawmakers passing HB 4017.

Washington

The Washington legislature closed on March 10, 2022, without passing SB 5813.