On April 13, 2023, the Indiana legislature passed SB 5. The bill largely tracks the Virginia Consumer Data Protection Act (VCDPA) with some limited variations.

The Senate originally passed the bill by a vote of 49-0 on February 9, 2023. The House passed an amended version of the bill by a vote of 98-0 on April 11, 2023. On April 13, 2023, the Senate concurred in the House amendments. Pending any remaining procedural hurdles, the bill will be sent to Indiana Governor Eric Holcomb in the coming days.

In the below post, we provide a summary of some of the bill’s unique provisions. Click here for a more detailed comparison of the Indiana bill against the six existing state privacy laws.

As noted, the Indiana bill largely tracks the VCDPA and, therefore, is more business-friendly than the Colorado and Connecticut laws but more consumer-friendly than the Utah and Iowa laws. That said, the bill has a few unique provisions, which we outline below.

Consumer Rights

Indiana residents will have the right to correct inaccuracies but only for personal data that they previously provided to the controller. The right does not extend to all personal data in a controller’s possession such as is the case in Colorado, Connecticut, and Virginia (Utah and Iowa lack this right entirely).

In addition, the bill’s right to access provision says that consumers have the right to obtain either a copy of their personal data or a “representative summary” of the consumer’s personal data the consumer previously provided to the controller. The choice is at the controller’s discretion.

As with the laws in Iowa, Utah, and Virginia, the Indiana bill does not require controllers to recognize universal opt-out mechanisms.

Consistent with the VCDPA, the bill defines “sale” to only mean monetary consideration and not “other valuable consideration.”

Enforcement / Right to Cure

The bill contains a thirty day right to cure violations, which does not sunset. During the committee hearing process, a representative from the Indiana Attorney General’s office stated that the Office wanted the right to cure to sunset but that amendment was never made to the bill. That leaves California, Colorado, and Connecticut as the three states where the right to cure has or will sunset.

Riverboat Casinos

In an interesting twist, the bill states that it does not restrict a controller or processor’s ability to, “in the case of an owner of a riverboat licensed under IC 4-33-6, implement and operate a facial recognition program approved by the Indiana gaming commission.” During the committee hearing process, it was explained that this provision is intended to allow riverboat casino operators to use facial recognition technology on their properties without violating the bill’s provisions.

Delayed Effective Date

The bill’s effective date is January 1, 2026, which is over two-and-a-half years away. That effective date is a year after Iowa’s January 1, 2025, effective date even though Iowa’s bill passed just last month.

During the Senate committee hearing process, Senator Brown (the bill’s primary author) explained that they intentionally chose an extended effective date to see how businesses implement the other state laws.

Ultimately, with its extended effective date, it is likely that other states will pass laws after Indiana but have them go into effect before Indiana’s law. For example, current bills under consideration in Texas (March 1, 2024), Washington (March 31, 2024), Montana (October 1, 2024), and New Hampshire (January 1, 2025), all have earlier effective dates.

Resources / Sample Notices

The Attorney General is permitted (but not required) to maintain on its website a list of resources for controllers, including sample privacy notices and disclosures, to assist controllers with compliance.

[View source.]