Keypoint: There were a number of developments this week: Florida’s House passed HB 969, the Washington Privacy Act officially died, Alaska’s HB 159 received a public hearing, and the Arizona legislature closed without passing its bill.
Below is our ninth weekly update on the status of proposed CCPA-like privacy legislation. Before we get to our update, we wanted to provide two reminders.
First, we have been regularly updating our 2021 State Privacy Law Tracker to keep pace with the latest developments. We encourage you to bookmark the page for easy reference.
In Florida, the House of Representatives passed HB 969 by a vote of 118 to 1. Its Senate counterpart, SB 1734, passed out of the Rules Committee on April 6, and has been waiting for a second reading since April 9. As we previously reported, the House and Senate bills contain notable differences, including that the House bill contains a private right of action whereas the Senate bill does not. At this point, the Florida Senate will need to act if Florida is going to pass a bill this year. It also will need to act quickly as the Florida legislature adjourns on April 30.
The Washington Privacy Act (WPA) is officially dead. As we previously reported, the WPA failed to pass the House by the April 11 deadline. However, on April 12, Senator Carlyle (the primary author of the WPA) tweeted that the “bill remains alive through the end of the session.” Well, the legislature closed on April 25 such that the WPA is now dead – for the third year in a row.
In Alaska, the House Labor and Commerce Committee held a hearing on HB 159 on April 23. You can access the recording here.
Finally, Arizona’s legislature closed on April 24 without passing its proposed bill.
To date, state lawmakers have introduced bills in 26 states. Multiple bills were introduced in Alaska, Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington. One state (Virginia) has passed legislation whereas the bills in nine states (Arizona, Kentucky, Maryland, Mississippi, North Dakota, Oklahoma, Utah, Washington, and West Virginia) have failed.
The below analysis divides the bills into four categories: (1) passed bills, (2) active bills, (3) introduced bills, and (4) dead bills.
Passed bills are those that have become law (i.e., Virginia). Active bills are those that have seen some movement, such as a committee hearing or vote. Introduced bills are those that have been introduced in a state legislature but have yet to see any movement (other than, for example, being referred to a committee). Dead bills are (as you might have guessed) bills that have failed.
For links to all of these bills please see our 2021 State Privacy Law Tracker.
On March 2, 2021, Virginia became the second state – after California – to enact state consumer data privacy legislation. You can find our coverage of the Virginia bill here, and you can find the text of the new law here. We also hosted a webinar on the law on March 11. You can access the recording here.
As discussed, the Florida House of Representatives passed HB 969 by a 118 to 1 vote. It is unclear if the Florida Senate will take any action on its companion bill before the legislature closes on April 30.
SB 893, which is similar to Virginia’s Consumer Data Protection Act, was reported out of Legislative Commissioner’s Office on April 8 and given a Senate calendar number. Senate Bill 156, a one-paragraph bill, introduced on January 15 has not seen movement since the Joint General Law Committee held a public hearing on February 25. The Connecticut legislature adjourns on June 9.
SB 116 and HB 159 were introduced on March 31. The House Labor and Commerce Committee held a hearing on HB 159 on April 23. You can access the recording here. The Alaska legislature adjourns on May 19.
On March 15, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255). A recording of the hearing is available here.
House Bill 216 was introduced on February 2, 2021. Notably, the bill has attracted 18 Republican sponsors or co-sponsors. However, to date, it has not moved forward and is currently referred to the House committee on Technology and Research. The bill is similar to the CCPA. The Alabama legislature adjourns on May 30.
SB21-190 was introduced on March 19, 2021. It was assigned to the Senate Committee on Business, Labor and Technology. You can read our analysis of the bill here. According to the legislative calendar, the deadline for bills to pass out of the Senate was April 7. The Colorado legislature adjourns on June 12.
Illinois is considering two bills.
First, HB 2404 (the Right to Know Act) is presently assigned to the Rules Committee. It had previously been assigned to the Cybersecurity, Data Analytics, & IT Committee. As its name suggests, the Right to Know Act would provide Illinois residents with the right to know certain information regarding their personal information.
In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (entitled the Consumer Privacy Act) on February 22. That bill was assigned to the Judiciary – Civil Committee on March 16, to the Civil Procedure & Tort Liability Subcommittee on March 23 and re-referred to the Rules Committee on March 27. HB 3910 is a modified version of the CCPA.
SD 1726 was filed on February 18, 2021. On March 29, it was referred to the joint committee on Advance Information Technology, the Internet and Cybersecurity. The bill is a modified version of Washington’s People’s Privacy Act. A second bill, HD 3847, was filed in the state house. On April 13, it also was referred to the joint committee on Advanced Information Technology, the Internet and Cybersecurity.
Minnesota is considering two bills – HF 36 and HF 1492 / SF 1408. The bills have not seen movement since being introduced.
HF 36 is a modified (and shortened) version of the CCPA and contains a private right of action. HF 1492 / SF 1408 are similar to the Washington and Virginia bills.
The Minnesota legislature adjourns on May 17.
On March 17, 2021, Nevada lawmakers introduced AB323 and SB260. AB323 failed on April 10. SB260 passed the Senate on April 20. The Nevada legislature adjourns on June 1.
As shown on our tracker, New York legislators have proposed a number of consumer privacy bills in 2021. All of those bills currently sit in committee. However, according to Joe Duball and Joseph Jerome, the Governor’s budget proposal no longer contains privacy provisions. The New York legislature adjourns on June 10.
Senate Bill 569 was introduced on April 6 and referred to the Committee on Rules and Operations of the Senate. The North Carolina legislature adjourns on July 2.
House Bill 1126 was introduced on April 7 and referred to the Consumer Affairs Committee.
H 3063 was pre-filed on December 9, 2020 and referred to the Committee on Labor on January 12, 2021. It has not moved since. The bill is limited to providing rights around the collection and use of biometric information. The South Carolina legislature adjourns on May 13.
In Texas, Representative Capriglione filed six bills “related to increasing the protection of consumer data by the private sector.” One bill, HB 3741, is a data privacy omnibus bill. As introduced, the bill is perhaps best described as a heavily modified version of the CCPA, however, there are many aspects of the bill that make it unique, including its creation of three “categories” of data. On March 22, the bill was referred to the House Committee for Business & Industry. The Texas legislature adjourns on May 31.
H.160 is still a short form bill (i.e., only one paragraph long). The bill has been referred to committee and no further action has been taken to date. The Vermont legislature adjourns on May 28.
Arizona’s HB 2865, Kentucky’s HB 408, Maryland’s SB 930, North Dakota’s HB 1330, Oklahoma’s HB 1602, Mississippi’s Senate Bill 2612, Utah’s SB 200, Washington’s SB 5062, and West Virginia’s HB 3159 have all died.