Keypoint: It was another busy week with committee movement on the Indiana and Iowa consumer privacy bills while lawmakers introduced six consumer privacy bills in Illinois, Massachusetts, Minnesota, New Hampshire, Vermont and Washington, four biometric privacy bills in Arizona, Massachusetts, Minnesota and Tennessee, and two children’s privacy bills in Massachusetts and West Virginia.
Below is the third weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.
First, we are regularly updating our 2023 State Privacy Law Tracker and new 2023 State Children’s Privacy Law Tracker with links to the consumer data privacy and children’s privacy bills. We encourage you to bookmark the pages for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- Consumer Data Privacy Bills
- Biometric Privacy Bills
- Children’s Privacy Bills
- Data Broker Bills
- Health Data Privacy Bills
- Automated Employment Decision Tools Bills
- Algorithmic Discrimination Bills
1. What’s New?
A lot happened last week.
First, we saw committee movement on consumer data privacy bills in Indiana and Iowa.
In Indiana, the Senate Committee on Commerce and Technology passed SB 5 by a vote of 11-0. A prior version of SB 5 passed the Senate last year but failed in the House. Given its progress last year, SB 5 is one of the bills we are closely monitoring for potential passage this year. The bill is based on the Virginia Consumer Data Protection Act.
Before voting through the bill, the Committee approved two amendments. First, the committee approved an amendment to sunset the right to cure in 2028 (i.e., two years after the bill goes into effect). Second, the committee passed an amendment to specifically allow casinos to use facial recognition technology.
At the hearing, a representative from the Indiana Attorney General’s office stated that the office “strongly supports” the bills. He also stated that the bill is “a little less aggressive than the California requirements or the Colorado requirements so it should be fairly simple for businesses outside the state to use the systems that they are already building to come into compliance” with the bill.
The Indiana Technology and Innovation Association and Indiana Chamber of Commerce also testified in support of the bill. Privacy advocates Consumer Reports and EPIC offered letters in opposition to the bill.
In her closing remarks, Senator Liz Brown referred to the bill as having a “glide path to implementation” because she will “watch how it works in California and Virginia” and if she thinks the bill does not go far enough or if there are loopholes, she promises to come back and revisit the bill.
Turning to Iowa, House Study Bill 12 passed 3-0 through an Economic Growth and Technology subcommittee. Last year, a version of HSB 12 passed through the Iowa House but failed in the Senate so we are closely watching the bill for potential passage this year. The Iowa bill is similar to the business-friendly Utah Consumer Privacy Act. For example, it does not contain a right to correction, requires notice and opt-out (not consent) to collect sensitive data, and does not require controllers to conduct data protection assessments or recognize universal opt-out mechanisms. Meanwhile, on January 23, 2023, lawmakers introduced a companion senate bill – Senate Study Bill 1071.
Last week we also saw lawmakers introduce six new consumer data privacy bills.
In Illinois, Representative Kam Buckner introduced HB 1381 – the Right to Know Act. The bill is narrow, focusing on disclosures and access to personal information.
In Massachusetts, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights. This is the third version of a privacy bill introduced this year in Massachusetts. The bill is based on GDPR and, among other things, would create a GDPR-like cross-border data transfer regime that even restricts transfers of personal data to other states.
In Minnesota, two Republican Senators introduced SF 950, which requires consent for the collection of personal information.
In New Hampshire, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255. The bill is based on last year’s Connecticut Data Privacy Act. Keep a close eye on this bill.
In Vermont, a bipartisan group of representatives introduced H.121. The bill seeks to amend Chapter 62 (Protection of Personal Information) of Vermont’s existing statutes. It would add requirements for the collection and use of data, charge the Attorney General’s office with identifying consumer rights through rulemaking, and require certain entities to recognize universal opt-out mechanisms. The bill also would amend and add additional obligations to Vermont’s existing data broker law, including breach notification obligations and the right for individuals to opt-out of certain types of processing. Finally, the bill would create BIPA-like obligations for the processing of biometric information.
In Washington, Representative Shelley Kloba reintroduced the People’s Privacy Act (HB 1616). Representative Kloba previously ran the bill in 2021, but did not introduce it in 2022. The People’s Privacy Act is a unique, consumer-friendly bill that does not follow the California or Virginia models. The bill was referred to the Civil Rights & Judiciary Committee.
Lawmakers also continued to introduce biometric privacy bills with bills filed in four states – Arizona (SB1238), Massachusetts (HD3053 and SD 2218), Minnesota (SF 954), and Tennessee (SB 339).
The number of states considering children’s privacy bills also continued to grow with Massachusetts Representative David Rogers introducing HD 2325 – An Act Relative to Internet Privacy Rights for Children. In addition, West Virginia Delegate Young introduced HB 2964 – the Online Privacy Protection for Children Act. West Virginia lawmakers already were considering another children’s bill – HB 2460. To help better track these bills we released our 2023 State Children’s Privacy Law Tracker last week.
In other news, the Washington House Committee on Civil Rights & Judiciary held a public hearing on HB1155 concerning health data privacy. The bill is now scheduled for executive session in the committee on February 1.
Finally, in New Jersey, the Labor Committee favorably reported A4909, which seeks to regulate the use of automated tools in hiring decisions to minimize discrimination in employment.
2. Upcoming Hearings
January 31, 2023
Hearing on Virginia SB 1432 (health records privacy) in Senate Subcommittee on Health
February 1, 2023
Washington HB1155 (health data privacy) scheduled for executive session in House Committee on Civil Rights and Judiciary
Oregon HB 2052 (data broker) scheduled for work session in the House Committee on Business and Labor
February 8, 2023
Hearing on Maryland SB0169 (biometric privacy) in the Senate Finance Committee
3. Consumer Data Privacy Bills
The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.
Hawaii
On January 20, 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110. SB 974 was referred to the Senate Committee on Commerce and Consumer Protection and the Senate Committee on Ways and Means. SB 1110 was referred to the Senate Committee on Commerce and Consumer Protection / Senate Judiciary Committee and the Senate Committee on Ways and Means.
Illinois
Representative Kam Buckner introduced HB 1381 – the Right to Know Act on January 24, 2023. The bill is a narrow, focusing on disclosures and access to personal information.
Indiana
Republican Senator Liz Brown introduced SB 5 on January 9, 2023. The bill was voted out of the Committee on Commerce and Technology by an 11-0 vote. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.
On January 19, 2023, Representative Chris Jeter filed HB 1554. HB 1554 is similar, but not identical, to SB 5 and includes additional provisions regarding data brokers and children. The bill was assigned to the Committee on Commerce, Small Business and Economic Development.
Iowa
House Study Bill 12 was introduced on January 12, 2023. On January 23, 2023, it passed a three-member subcommittee of the Economic Growth and Technology Committee. Last year, the Iowa House passed House File 2506 but it stalled in the Senate.
Meanwhile, on January 23, 2023, lawmakers introduced a companion senate bill – Senate Study Bill 1071. That bill was referred to the Technology Committee.
Kentucky
Republican Senator Whitney Westerfield introduced SB15 on January 5, 2023. The bill was referred to the Committee on Economic Development, Tourism and Labor. Last year, Senator Westerfield filed SB15.
Massachusetts
Massachusetts lawmakers have introduced three competing bills.
First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.
Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Finegold and in the House (HD 3263) by Representative Daniel Carey.
Third, Representative Russell Holmes introduced HD 3245 – the Internet Bill of Rights.
Minnesota
Two Republican Senators introduced SF 950, which would require consent for the collection of personal information. The bill was referred to the Commerce and Consumer Protection Committee.
Mississippi
Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill was referred to the Judiciary Committee. Last year, Senator Turner-Ford introduced SB 2330.
New Hampshire
On January 19, 2023, a bipartisan and bicameral group of lawmakers led by Senator Sharon Carson introduced SB 255.
New Jersey
Three bills that we tracked last year have carried over to the 2023 session – S332, A505, and A1971. The bills remain in committee. These bills are not as broad as the other bills discussed in this section.
New York
On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.
On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). The bill was referred to the Consumer Affairs and Protection Committee.
On January 19, 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). The bill was referred to the Internet and Technology Committee. Both of the bills were filed in 2022.
Oklahoma
Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The Oklahoma legislature will open February 6, 2023. Representative West filed privacy legislation the last two years with the bills passing the House but not the Senate. In previous years, the bills were co-sponsored by Collin Walke who retired from the House. As in prior years, the hallmark of the OCDPA is that it would require consumer consent for all personal data collection.
Oregon
Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619. The bill was filed at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. The bill was referred to the Joint Committee on Ways and Means.
Tennessee
Republic Senator Bo Watson introduced SB73 on January 4, 2023. On January 20, 2023, the bill was referred to the Senate Commerce & Labor Committee. The bill text is available here. Tennessee lawmakers considered a similar bill last year.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development.
Washington
Representative Shelley Kloba reintroduced the People’s Privacy Act (HB 1616) on January 26, 2023. Representative Kloba previously ran the bill in 2021, but did not introduce it in 2022. The bill was referred to the Civil Rights & Judiciary Committee.
4. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills:
Arizona
Senator Rogers introduced SB1238.
Hawaii
The Hawaii Biometric Information Privacy Act (SB 1085) was introduced on January 20, 2023. The bill was referred to the Senate Committee on Labor and Technology and Committee on Judiciary.
Maryland
Delegates Love, Charkoudian, Lehman, and Watson introduced HB 33 on January 11, 2023. The bill was referred to the Economic Matters Committee. Last year, the Maryland House passed HB 259, but the bill did not make it out of the Senate. On January 20, 2023, a group of thirteen senators cross-filed SB0169 in the Senate. The bill was referred to the Finance Committee.
Massachusetts
Representative Fernandes introduced HD3053 and Senator Montigny introduced SD 2218.
Mississippi
Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.
Minnesota
Senator Lucero introduced SF 954. The bill was referred to the Commerce and Consumer Protection Committee.
New York
On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). The bill was referred to the Consumer Affairs and Protection Committee.
On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or any other identified activities. The bill was referred to the Consumer Protection Committee.
Tennessee
Senator Campbell introduced SB 339on January 23, 2023. The bill was referred to the Senate Commerce and Labor Committee.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development.
5. Children’s Privacy Bills
The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills. The bills are also tracked on our 2023 State Children’s Privacy Law Tracker.
Massachusetts
Representative Rogers introduced HD 2325 (An Act Relative to Internet Privacy Rights for Children).
New Jersey
Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Oregon
Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Texas
Texas lawmakers are considering HB 896, which would prohibit an individual between 13 and 18 years of age from using a social media platform.
Virginia
Lawmakers introduced companion bills to amend the Virginia Consumer Data Protection Act (VCDPA) (HB 1688 / SB 1026). The bills would amend the VCDPA by (1) re-defining “child” to be a person under 18 years of age (and not under 13); (2) require operators to obtain parental consent prior to registering a child for their product or services; and (3) require operators to not knowingly process the personal data of a child for purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.
The House bill was referred to the Committee on Communications, Technology and Innovation. The Senate bill was referred to the Committee on General Laws and Technology where it was passed by indefinitely on January 25, 2023.
West Virginia
Delegate Wayne Clark introduced HB 2460 on January 11, 2023. The bill states that it is intended to “complement the body of federal law governing online privacy protections for children” and would extend protections to children under 18. The bill was referred to the House Judiciary Committee.
Delegate Young introduced HB 2964 – the Online Privacy Protection for Children Act – on January 24, 2023. The bill was referred to the House Judiciary Committee.
6. Data Broker Bills
The following states are considering bills that would regulate data brokers:
New Jersey
Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Oregon
HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023. Last year lawmakers considered HB 4017.
Vermont
On January 26, 2023, a bipartisan group of representatives introduced H.121. The bill was referred to Committee on Commerce and Economic Development. The bill would amend Vermont’s existing data broker statute to add additional requirements.
7. Health Data Privacy Bills
The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:
Massachusetts
Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.
New York
Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee.
Virginia
Lawmakers are considering companion bills HB 2219 and SB 1432. The House bill was referred to the Committee on Health, Welfare and Institutions. The Senate bill was referred to the Committee on Education and Health.
Washington
Companion bills were filed in the House (HB 1155) and Senate (SB 5351). The House bill was referred to the Civil Rights & Judiciary Committee. The Senate bill was referred to the Law & Justice Committee.
8. Automated Employment Decision Tools Bills
The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.
New Jersey
A group of assembly members introduced A4909 on December 5, 2022. On January 19, 2023, the Assembly Labor Committee favorably reported the bill by a vote of 8-1.
An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.
New York
Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee.
9. Algorithmic Discrimination Bills
These bills would protect against algorithmic discrimination and promote transparency such as the Washington, D.C. Stop Discrimination by Algorithms Act of 2021 (B24-0558). Our focus is on bills that impact businesses, not government. No states have proposed such legislation to date.