Early Takeaways from This Year’s State Privacy Legislation

Just a few weeks into the 2022 legislative sessions, we have already seen lawmakers introduce major privacy bills in 13 states and D.C., and that does not even include the bills that carried over from last year in certain states. Here are a few takeaways from the legislation introduced so far this year.

Early Privacy Trends in the 2022 State Sessions

After Coming Close Last Session, Several States Are Back

Florida, Oklahoma, and Washington are back with new privacy bills after coming close to passing legislation in 2021. These states all saw comprehensive privacy bills pass the first chamber before stalling last year. Undeterred, the bill sponsors have returned with new legislation in 2022:

• In Florida, Rep. Fiona McFarland (R) and Sen. Jennifer Bradley (R) have returned with legislation in their respective chambers. The bills are similar in many respects, but the House version has a private right of action and requires an "opt-in" provision for data related to minors.
  

• In Oklahoma, Rep. Josh West (R) and Rep. Collin Walke (D) have filed two bills for when the session begins in February — HB 2968 and HB 2969. Both bills lack a private right of action, unlike HB 1602, which carries over from last year.
  

• Washington Sen. Reuven Carlyle (D) will try to pass privacy legislation for a fourth year in a row. His bill, SB 5813 adds new protections for minors, requires data broker registration, and requires a "do not track" mechanism. The House has their own Washington Foundational Data Privacy Act (HB 1850) that is similar to Virginia's law, but includes a private right of action.
  
  

Virginia Looking to Make Tweaks

Virginia lawmakers have proposed several bills to amend the Virginia Consumer Data Protection Act, which passed last year but won't go into effect until 2023. Some of the proposed bills would clarify the definition of "nonprofit organization" under the law; allow the state attorney general to pursue actual damages if a violation exists past the 30-day cure period; or provide how a controller who has obtained personal data from a source other than the consumer can comply with a consumer request to delete the data.

More "Opt in" Provisions

Most privacy legislation we have seen so far give consumers the right to opt out of the processing of their personal information, but there are a pair of bills in New Jersey that require consumers to opt in before their information is processed, much like an Oklahoma bill (HB 1602) that has carried over to the 2022 session. Other bills introduced this year require consumer opt in only for processing certain sensitive information or data related to minors.

Uniform Law Commission Model Legislation

Last summer, the Uniform Law Commission (ULC) finalized its model legislation that departed from the laws enacted in California and Virginia. Instead, the ULC model would set up tiers of data practices: compatible data practices (where consumer consent is not generally required), incompatible data practices (where consumer consent is generally required), and prohibited data practices. Lawmakers in Nebraska, Oklahoma, and the District of Columbia have already introduced legislation based on the ULC model.

Private Right of Action Remains a Contentious Issue

In 2021, Colorado and Virginia enacted laws without a private right of action, while bills in Florida, Oklahoma, and Washington were held up on account of that provision. Despite disagreements on that point, sponsors have returned with legislation in 2022 that includes a private right of action in those states. Most states have followed the lead of Colorado and Virginia with legislation that leaves enforcement in the hands of the state attorney general. But expect the issue to arise in committee hearings as some bill proponents push for stronger enforcement.

Other Potential State Activity

Here is other potential activity we're hearing about this session:

• In Arizona, Rep. Domingo DeGrazia (D) has already said he will file at least one privacy bill this year, after sponsoring a bill last year.

• Connecticut Sen. James Maroney (D) has vowed to return "with a stronger bill" after attempting to insert privacy language in the budget bill last year.

• The Oregon Attorney General's office is drafting a bill to require data brokers to register with the state.

• Tennessee lawmakers will use HB 1467 as a vehicle to insert provisions on privacy.

• Vermont lawmakers have introduced a bill that will "enhance data protections,” however there isn’t any text yet (though we do believe this will likely be a comprehensive privacy bill).

Need More Privacy Policy Analysis?

For the latest activity on these bills, plus other privacy and technology related legislation, learn more about how MultiState can help you track your mission-critical issues, or get in touch here for a demo of our legislative tracking solution.