Spring Is Hot for State Privacy Legislation

Carlton Fields
Contact

Carlton Fields

It’s a hot spring for state privacy legislation. Privacy bills are pending in roughly 20 states, and while Gramm-Leach-Bliley Act (GLBA) exemptions may act as a cool breeze in some, issues remain:

  • Some states’ legislation has no GLBA exemption.
  • Some states’ legislation only contains a data-level exemption, meaning non-GLBA data would be subject to the states’ privacy requirements.
  • Even those states’ legislation that contains such an entity-level exemption will not insulate insurers from contractual obligations imposed by third parties who are subject to the legislation.

Virginia is the first state to follow California’s lead in adopting comprehensive privacy legislation, but its Consumer Data Protection Act has an entity-level GLBA exemption preventing any direct application to insurers. California, at work again, amended its Consumer Privacy Act (CCPA) by adopting the California Privacy Rights Act (CPRA), effective January 1, 2023. Below is a summary of the CPRA’s impact on insurers and the scope of the GLBA exemptions in pending legislation.

Some of the CPRA’s key impacts on insurers include:

  1. Clarifying the scope of the GLBA exemption by revising the exemption to cover “personal information collected, processed, sold, or disclosed subject to,” (rather than “pursuant to”) the GLBA or the California Financial Information Privacy Act.
  2. Expanding the private right of action insurers would face following breaches where the insurer failed to provide reasonable security to protect personal information.
  3. For non-exempt data, insurers will need to:
    • Update California privacy notices to address a new category of PI, “sensitive personal information,” and provide a right to opt out of its sharing. “Sensitive personal information” includes information such as Social Security number, driver’s license information, financial account information, race, ethnicity, religion, biometrics, and health information.
    • Revisit/revise vendor relationships/contractual requirements related to consumer data.
    • Implement data minimization.
    • Address new requirements for “cross-context behavioral advertising” (advertising targeting consumers based on their PI obtained from the consumer’s activity across businesses, websites, applications, etc., other than those with which the consumer intentionally interacts).

Pending Privacy Legislation

State Law/ Bill

Scope of GLBA Exemption

GLBA Exemption

 

AL HB 216

Data-level

PI collected, processed, sold, or disclosed pursuant to GLBA

AZ HB 2865

Data-level

Data sets regulated by GLBA

CO SB21-190

Data-level

PI collected, processed, sold, or disclosed pursuant to GLBA, if collection, processing, sale, or disclosure is in compliance with GLBA

CT SB 893

Entity-level

Financial institution or data subject to Title V of GLBA

FL HB 969

Data-level

PI collected, processed, sold, or disclosed pursuant to GLBA

FL SB 1734

Data-level, but Sen. Bradley has suggested that it may function as entity-level

PI collected, processed, sold, or disclosed pursuant to GLBA

IL HB 3910

Limited data-level

PI collected, processed, sold, or disclosed in accordance with GLBA or the Illinois Banking Act (except for private right of action given to consumers whose PI is breached due to business’s failure to implement and maintain reasonable security)

KY HB 408

Entity-level

A financial institution or an affiliate of a financial institution that is subject to GLBA

MD SB 0930

Data-level

PI collected, processed, sold, or disclosed under GLBA

MA SD 1726

None

N/A

MN HF 1492

Data-level

PI collected, processed, sold, or disclosed pursuant to GLBA, if collection, processing, sale, or disclosure is in compliance with GLBA

MN HF 36

None

N/A

NJ AB 5448

Entity-level

A financial institution or an affiliate of a financial institution that is subject to GLBA

NY A 680

Data-level

Data to the extent regulated by GLBA

NY SB 567

None

N/A

NY p. 148 of PPGG Bill

Data-level

PI collected, stored, or otherwise used in accordance with GLBA

OK HB 1602

Data-level

PI collected, processed, sold, or disclosed in accordance with GLBA

TX HB 3741

Data-level

PI processed in accordance with GLBA

UT SB 200

Entity-level

Financial institution or affiliate of same governed by Title V of GLBA

WA HB 1433

None

N/A

WA SB 5062

Data-level

PI collected, processed, sold, or disclosed pursuant to GLBA, if collection, processing, sale, or disclosure is in compliance with GLBA

WV HB 3159

None

N/A

Time will tell how many of the above bills pass, the modifications they will undergo before passage, and whether federal legislation, such as the Information Transparency and Personal Data Control Act introduced in Congress by Rep. Suzan DelBene (D-Wash.), which specifically preempts state privacy laws, will pass and nullify them all.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Carlton Fields | Attorney Advertising

Written by:

Carlton Fields
Contact
more
less

Carlton Fields on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.