State privacy legislation

Keypoint: Nebraska is the seventeenth state legislature to pass consumer data privacy legislation with a bill that largely tracks the Texas Data Privacy and Security Act.

On April 11, 2024, the Nebraska legislature passed the Nebraska Data Privacy Act (LB 1074). We have been tracking the bill since it was first introduced under LB 1294. That bill never advanced out of committee; however, it was added to LB 1074 in late March as part of a larger multi-subject 139 page bill. The bill unanimously passed Nebraska’s unicameral legislature on April 11. It now heads to Nebraska Governor Jim Pillen. Assuming the bill becomes law, Nebraska will become either the sixteenth or seventeenth state to enact consumer data privacy legislation, depending on whether Maryland’s bill, which passed the Maryland legislature last Saturday, is enacted first.

The Nebraska bill largely tracks the Texas Data Privacy and Security Act, but with some differences we identify below. As with prior bills, we have added the Nebraska bill to our chart providing a detailed comparison of laws enacted to date. We also have added Nebraska to our sensitive data comparison chart.Continue Reading Nebraska Legislature Passes Consumer Data Privacy Bill

Keypoint: Maryland’s bill diverges from other Washington Privacy Act variants passed to date with unique data minimization, sensitive data, minor’s data privacy, and unlawful discrimination provisions (among others).

On April 6, 2024, the Maryland legislature passed the Maryland Online Data Privacy Act of 2024 (MODPA) (SB 541). A companion House bill (HB 567) also appears likely to pass before the legislature closes on April 8. Subject to the procedural formalities in the legislature, the bills will next head to Maryland Governor Wes Moore for consideration.

Assuming MODPA becomes law, Maryland will become the sixteenth state to pass broad consumer data privacy legislation. However, Maryland will be the first state to pass a Washington Privacy Act variant that contains unique provisions regarding data minimization, sensitive data, minor’s data privacy, and unlawful discrimination – among other provisions. In doing so, Maryland injects a new wrinkle into the state privacy law debate much like Washington did with last year’s My Health My Data Act. MODPA also contains a low threshold for applicability such that even smaller companies may need to comply with its provisions.

The below article analyzes MODPA’s contours, including some of its more notable provisions and deviations. We also have added MODPA to our chart providing a detailed comparison of the laws enacted to date. It should be noted that – as of the date of this article – the bills available on the legislature’s website have not yet been updated to reflect the final amendments although we have included those amendments in our analysis.

The Maryland legislature also passed Age-Appropriate Design Code Act companion bills (SB 571 / HB 603). We will provide a separate article analyzing those bills.Continue Reading Maryland Legislature Passes Consumer Data Privacy Bill

Keypoint: Last week, the Maryland legislature passed consumer data privacy and Age-Appropriate Design Code Act bills, the Kentucky Governor signed HB 15 into law, three bills advanced out of a California Assembly Committee, and there was movement with bills in Minnesota, Vermont, Louisiana, Illinois and Colorado.

Below is the eleventh weekly update on the status of proposed state privacy legislation in 2024.Continue Reading Proposed State Privacy Law Update: April 8, 2024

Keypoint: Last week, consumer data privacy bills passed out of the Vermont and Pennsylvania Houses, an Age-Appropriate Design Code Act variant bill passed out of the Vermont Senate, and bills advanced in Colorado, Maryland, Minnesota, and Georgia.

Below is the ninth weekly update on the status of proposed state privacy legislation in 2024.Continue Reading Proposed State Privacy Law Update: March 25, 2024

Keypoint: It was a very busy week with Kentucky on the cusp of passing a consumer data privacy bill, Maryland advancing consumer and children’s bills, and movement on bills in Minnesota, Vermont, Georgia, Maine, and New York.

Below is the eighth weekly update on the status of proposed state privacy legislation in 2024.Continue Reading Proposed State Privacy Law Update: March 18, 2024

Keypoint: While not as far-reaching as bills under consideration in other states, the Utah bill creates some obligations for private sector companies deploying generative artificial intelligence, including disclosing its use.

In early March, the Utah legislature unanimously passed SB 149. The bill is now with Utah Governor Spencer Cox for signature. In general, the bill: (1) specifies that Utah’s consumer protection laws apply equally to an entity’s use of generative artificial intelligence as they do to the entity’s other activities, (2) requires private sector entities to take steps to disclose and/or respond to inquiries about their use of generative artificial intelligence, and (3) creates the Office of Artificial Intelligence Policy which is charged with, among other things, administering an artificial intelligence learning laboratory program. Once signed by the Governor, the law will go into effect on May 1, 2024.

In the below article, we provide a brief analysis of the bill’s provisions.Continue Reading Utah Legislature Passes Private Sector AI Bill

Keypoint: Last week, consumer data privacy bills advanced in Minnesota, Maryland, and Missouri, New Hampshire’s Governor signed SB 255 into law, Maryland’s AADC bill advanced in the Senate, and the Hawaii House passed a consumer health data privacy bill.

Below is the seventh weekly update on the status of proposed state privacy legislation in 2024.Continue Reading Proposed State Privacy Law Update: March 11, 2024