Keypoint: April 2023 saw developments in chat, session replay, voice recording, and VPPA litigation along with two new trends to watch in May.

This is our second installment in our monthly data privacy litigation reports to provide updates on how courts in the United States have handled emerging data privacy trends in the past month. In this post we look at developments in lawsuits relating to chat wiretap claims, session replay claims, VPPA claims, and voice recording lawsuits. (If any of these case theories are new to you, be sure to check out the “Overview” section at the bottom of the post.) We also analyze two new theories that have already spawned a series of demand letters and lawsuits.

There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out. The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.

Keypoint: Last week the Washington Governor signed the My Health My Data Act, the Nevada Senate passed a health / biometric privacy bill, the Florida Senate passed a consumer privacy bill, and the Texas House and Florida House passed children’s social media privacy bills.

Below is the sixteenth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Keypoint: Last week the legislatures in Montana and Tennessee passed consumer data privacy bills and the Washington legislature passed the My Health My Data Act.

Below is the fifteenth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Keypoint: Montana becomes first Republican-controlled legislature to pass a consumer data privacy bill requiring controllers to recognize universal opt out mechanisms, providing additional rights for children, sunsetting the right to cure, and adjusting the applicability threshold to take into account a state’s smaller population.

On April 21, 2023, the Montana legislature unanimously passed Republican Senator Daniel Zolnikov’s SB 384. In doing so, Montana became the first Republican-controlled legislature to pass a consumer privacy bill with provisions that closely align with last year’s Connecticut Data Privacy Act (CTDPA). As a result, Montana joins California, Colorado, and Connecticut as states with the strongest consumer data privacy bills passed to date. In a first, the Montana bill lowers the traditional 100,000 consumer threshold to 50,000 to presumably take into account Montana’s smaller population.

Pending any remaining procedural formalities, the bill will be sent to Montana Governor Greg Gianforte in the coming days. Governor Gianforte can sign the bill, veto it, or allow it become law without his signature.

In the below post, we provide a summary of some of the bill’s more notable provisions. Click here for a more detailed comparison of the Montana bill against the seven bills passed to date.

Keypoint: New York City issued final regulations on the use of automated employment decision tools by employers, with enforcement to begin on July 5, 2023.

The New York City Department of Consumer and Worker Protection (DCWP) adopted its Final Rule to implement Local Law 144, which regulates the use of “automated employment decision tools” (AEDTs) to screen applicants or employees in the city. The DCWP also announced that it will begin enforcing the law on July 5, 2023.

Keypoint: With a private right of action, broad applicability to businesses of all sizes and types, a scope that is broader than its name suggests, and strong consent-based requirements and privacy rights, the Washington My Health My Data Act will be a transformative privacy law for the United States.

On April 17, 2023, the Washington legislature passed the My Health My Data Act (MHMD) (HB 1155). The bill now heads to the Washington Governor who can sign it, veto it, or allow the bill to become law without signature.

We have been tracking MHMD since it was first introduced in early January, provided a detailed analysis of the bill after it first passed the House in mid-March, and discussed its definition of “consumer health data” and private right of action in our April 10 weekly post. In the below post, we add to our analysis by providing five key takeaways about MHMD.

Keypoint: Last week the Indiana legislature passed a consumer data privacy bill.

Below is the fourteenth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Keypoint: The Indiana legislature is the seventh state legislature to pass consumer data privacy legislation.

On April 13, 2023, the Indiana legislature passed SB 5. The bill largely tracks the Virginia Consumer Data Protection Act (VCDPA) with some limited variations.

The Senate originally passed the bill by a vote of 49-0 on February 9, 2023. The House passed an amended version of the bill by a vote of 98-0 on April 11, 2023. On April 13, 2023, the Senate concurred in the House amendments. Pending any remaining procedural hurdles, the bill will be sent to Indiana Governor Eric Holcomb in the coming days.

In the below post, we provide a summary of some of the bill’s unique provisions. Click here for a more detailed comparison of the Indiana bill against the six existing state privacy laws.

Keypoint: Last week the Washington Senate passed the My Health My Data Act, the Arkansas legislature passed the Social Media Safety Act, and the Texas House passed the Texas Data Privacy and Security Act.

Below is the thirteenth weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.

First, we are regularly updating our 2023 State Privacy Law Tracker, 2023 State Children’s Privacy Law Tracker, and 2023 State Biometric Privacy Law Tracker. We encourage you to bookmark the pages for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Keypoint: In March 2023, more California courts tackled motions to dismiss claims that chat features violate wiretapping laws while Georgia and Minnesota courts weighed in on VPPA claims.

This is the first of our monthly data privacy litigation reports to provide updates on how courts have handled emerging data privacy tends in the past month. In this post we look at developments in lawsuits relating to chat wiretap claims, session replay claims, VPPA claims, and BIPA claims. (If any of these case theories are new to you, be sure to check out the “Overview” section below.) There are many courts currently handling data privacy cases across the nation. Although illustrative, this update is not intended to be exhaustive. If there is another area of data privacy litigation about which you would like to know more, please reach out.

The contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following us on LinkedIn.