Keypoint: This week the Delaware House passed a data broker bill, the Connecticut Data Privacy Act was sent to the Governor, Louisiana scheduled a hearing on its bill, and the Hawaii legislature closed without passing a bill.
Below is our seventeenth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide two reminders.
First, we regularly update our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
1. What’s New?
In Delaware, the House passed HB 262 on May 5, 2022, by a vote of 27-13. The bill seeks to regulate data brokers. It is now assigned to the Senate Banking, Business & Insurance Committee.
In Connecticut, SB6 – the Connecticut Data Privacy Act (CTDPA) – was transmitted to Governor Lamont on May 5, 2022. The Governor has fifteen days to act on the legislation. The bill will become law if he either signs it or does nothing. We provided a webinar on the CTDPA on May 5, 2022. Click here to access the recording.
In California, a hearing was set in the Appropriations Committee for May 9, 2022 on SB 1059 (amendments to the California data broker bill) but it was subsequently postponed.
Finally, the Hawaii legislature adjourned without passing a bill.
2. Upcoming Hearings
Public hearing on Louisiana HB987 in the House Commerce Committee.
Please note that many hearings are scheduled on short notice, and it is possible that more hearings could be noticed and held during this time frame.
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska lawmakers are considering three bills – HB 222, HB 159 and SB 116. On February 4, 2022, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The House Judiciary Committee held hearings on February 7, 2022 and March 18, 2022.
The Arizona legislature closed on April 23, 2022, without passing a bill.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
The Florida legislature closed on March 11, 2022, without passing a bill.
The Georgia legislature closed on April 4, 2022, without passing a bill.
The Hawaii legislature closed on May 5, 2022, without passing a bill.
The Indiana legislature closed on March 14, 2022, without passing a bill.
The Iowa legislature closed on April 19, 2022, without passing a bill.
The Kentucky legislature closed on April 15, 2022, without passing a bill.
On April 5, 2022, Representative Deshotel introduced HB 987 – the Louisiana Consumer Privacy Act. The bill is similar to the Utah Consumer Privacy Act. It was referred to the Committee on Commerce, which will hold a hearing on May 9.
The Maine legislature closed on April 20, 2022, without passing a bill.
The Maryland legislature closed on April 11, 2022, without passing a bill.
The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. The bill is now filed under S.2687 and H.4514 (the Massachusetts Information Privacy and Security Act). On February 14, 2022, S.2687 was referred to the Senate Ways and Means Committee. On March 3, 2022, H.4514 was referred to the Joint Healthcare Finance Committee.
On April 12, 2022, fifteen Michigan House Democrats introduced HB 5989. It was read a first time and referred to the House Committee on Communications and Technology.
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins has not introduced a bill to date. According to the Minnesota legislature’s committee deadlines webpage, the deadline for bills to get out of committee in their house of origin passed on March 25, 2022.
SB 2330 died in committee.
The Nebraska legislature closed on April 20, 2022, without passing a bill.
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. On February 8, 2022, the New York Senate Consumer Affairs Committee voted S6701A out of committee. The bill was reported and committed to the Internet and Technology Committee.
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. On February 9, 2022, the Ohio House Government Oversight Committee voted the bill out of committee. On February 16, 2022, the status of the bill was changed to “informally passed.” On February 22, 2022, the bill was re-referred to the Rules and Reference Committee.
On March 23, 2022, the Oklahoma House voted to pass Representative Collin Walke’s HB 2969. If passed, the bill would require businesses to obtain consumer consent for the collection of personal information. The bill was assigned to the Senate Judiciary Committee. According to the Oklahoma legislative calendar, April 14 was the deadline for HB 2969 to make it out of a Senate Committee.
According to Representative Walke, HB 1602, which passed the Oklahoma House last year but stalled in the Senate Judiciary Committee and carried over to 2022, is now dead. In addition, Oklahoma Representative O’Donnell introduced HB 3477. The bill is based on the Uniform Law Commission’s model act. It appears that bill also is dead.
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill – HB2202. That bill also was referred to the House Consumer Affairs Committee, which will hold a hearing on the bill on May 25, 2022.
Finally, on January 20, 2022, lawmakers introduced a third bill – HB 2257 – which also was referred to the House Consumer Affairs Committee.
On March 22, 2022, the House Innovation, Internet & Technology Committee held a hearing on HB 7400. The committee recommended that the measure be held for further study.
On March 31, 2022, the House State Government & Elections Committee held a hearing on HB7917. The committee recommended that the measure be held for further study.
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.
The Tennessee legislature closed on April 21, 2022, without passing a bill.
Utah Governor Spencer Cox signed the Utah Consumer Privacy Act (SB 227) on March 24, 2022, officially making Utah the fourth state to pass consumer data privacy legislation. Click here to access our 18 minute on-demand webinar on the UCPA.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development. The House Committee on Commerce and Economic Development held a hearing on H.570 on March 16, 2022. Draft language was submitted as part of the meeting materials.
The Washington legislature closed on March 10, 2022, without passing a bill.
The West Virginia legislature closed on March 12, 2022, without passing a bill.
The Wisconsin legislature closed on March 10, 2022, without passing a bill.
4. VCDPA Amendments
On April 11, 2022, Virginia Governor Glenn Youngkin signed three Virginia Consumer Data Protection Act (VCDPA) amendment bills into law.
5. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills:
SB 1189 was introduced on February 18, 2022. On April 5, 2022, the Judiciary Committee passed an amended version of the bill. It was read a second time and re-referred to the Appropriations Committee, which held a public hearing on April 25, 2022. The bill was placed on the Appropriations suspense file.
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure. On February 14, 2022, the bill was incorporated into S.2687.
HB 2716 was introduced on February 16, 2022.
Bills proposed in Kentucky, Maine, Maryland, and West Virginia failed to pass this year.
6. Data Broker Bills
Two states are considering bills to regulate data brokers:
On May 5, 2022, the House passed HB 262 by a vote of 27-13. The bill was assigned to the Senate Banking, Business & Insurance Committee.
Bills proposed in Oregon and Washington.