- New comprehensive privacy bills in 13 states have already been filed or introduced for this session, and will be considered with the bills from 2021 that have carried over this year.
- More legislation includes opt in provisions for certain data, with some bills requiring opt in for all data.
- Whether or not legislation has a private right of action continues to be a contentious issue, with House members in Florida, Oklahoma, and Washington continuing to push bills that allow consumers to sue.
Just a few weeks into the 2022 legislative sessions, we have already seen lawmakers introduce major privacy bills in 13 states and D.C., and that does not even include the bills that carried over from last year in certain states. Here are a few takeaways from the legislation introduced so far this year.
Early Privacy Trends in the 2022 State Sessions
After Coming Close Last Session, Several States Are Back
Florida, Oklahoma, and Washington are back with new privacy bills after coming close to passing legislation in 2021. These states all saw comprehensive privacy bills pass the first chamber before stalling last year. Undeterred, the bill sponsors have returned with new legislation in 2022:
In Florida, Rep. Fiona McFarland (R) and Sen. Jennifer Bradley (R) have returned with legislation in their respective chambers. The bills are similar in many respects, but the House version has a private right of action and requires an "opt-in" provision for data related to minors.
In Oklahoma, Rep. Josh West (R) and Rep. Collin Walke (D) have filed two bills for when the session begins in February — HB 2968 and HB 2969. Both bills lack a private right of action, unlike HB 1602, which carries over from last year.
Washington Sen. Reuven Carlyle (D) will try to pass privacy legislation for a fourth year in a row. His bill, SB 5813 adds new protections for minors, requires data broker registration, and requires a "do not track" mechanism. The House has their own Washington Foundational Data Privacy Act (HB 1850) that is similar to Virginia's law, but includes a private right of action.
Virginia Looking to Make Tweaks
Virginia lawmakers have proposed several bills to amend the Virginia Consumer Data Protection Act, which passed last year but won't go into effect until 2023. Some of the proposed bills would clarify the definition of "nonprofit organization" under the law; allow the state attorney general to pursue actual damages if a violation exists past the 30-day cure period; or provide how a controller who has obtained personal data from a source other than the consumer can comply with a consumer request to delete the data.
More "Opt in" Provisions
Most privacy legislation we have seen so far give consumers the right to opt out of the processing of their personal information, but there are a pair of bills in New Jersey that require consumers to opt in before their information is processed, much like an Oklahoma bill (HB 1602) that has carried over to the 2022 session. Other bills introduced this year require consumer opt in only for processing certain sensitive information or data related to minors.
Uniform Law Commission Model Legislation
Last summer, the Uniform Law Commission (ULC) finalized its model legislation that departed from the laws enacted in California and Virginia. Instead, the ULC model would set up tiers of data practices: compatible data practices (where consumer consent is not generally required), incompatible data practices (where consumer consent is generally required), and prohibited data practices. Lawmakers in Nebraska, Oklahoma, and the District of Columbia have already introduced legislation based on the ULC model.
Private Right of Action Remains a Contentious Issue
In 2021, Colorado and Virginia enacted laws without a private right of action, while bills in Florida, Oklahoma, and Washington were held up on account of that provision. Despite disagreements on that point, sponsors have returned with legislation in 2022 that includes a private right of action in those states. Most states have followed the lead of Colorado and Virginia with legislation that leaves enforcement in the hands of the state attorney general. But expect the issue to arise in committee hearings as some bill proponents push for stronger enforcement.
Other Potential State Activity
Here is other potential activity we're hearing about this session:
For the latest activity on these bills, plus other privacy and technology related legislation, learn more about how MultiState can help you track your mission-critical issues, or get in touch here for a demo of our legislative tracking solution.