Keypoint: It was another busy week with developments in Washington, Florida, Oklahoma, Alaska, Nevada, and Rhode Island.
For the sixth week in a row, we are providing an update on the status of proposed CCPA-like privacy legislation. Before we get to our update, we wanted to provide three notes.
First, we are pleased to announce the results of our poll on whether to call Virginia’s new privacy law – the Virginia Consumer Data Protection Act – the CDPA or VCDPA. By an overwhelming 85-15% margin readers prefer VCDPA to CDPA.
Second, we have been regularly updating our 2021 State Privacy Law Tracker to keep pace with the latest developments. We encourage you to bookmark the page for easy reference.
There were a number of notable developments this week.
In Washington, the House Committee on Appropriations passed the Washington Privacy Act (WPA) out of committee. Before doing so, the Committee held a public hearing at which numerous individuals testified against the bill, including both pro-business and pro-privacy advocates. The WPA is now referred to Rules 2 Review. It bears emphasizing that this year’s WPA is still on the same track as last year’s WPA. Ultimately, just like last year, it appears that the Senate and House will need to agree on the enforcement mechanism for the bill to pass.
In Oklahoma, the author of the Oklahoma Computer Data Privacy Act, Representative Collin Walke, gave an impassioned speech at a press conference on April 1, in which he reported that the bill has been held up in the Senate Judiciary Committee. By way of background, the bill passed the Oklahoma house on March 4 but has been sitting with the Senate Judiciary Committee since March 22. The Senate Judiciary Committee has not placed the bill on a meeting agenda to date and the bill is not on the committee’s April 6 agenda. According to the Senate calendar, house measures must pass out of committee by April 8.
We contacted Representative Walke late last week and he reported that there still is a “slim chance” the committee will hear the bill next week or transfer it to another committee before the April 8 deadline. However, if the bill is not heard this session, it will still be eligible for next session.
In Alaska, Governor Mike Dunleavy introduced two new bills. Thanks to Bloomberg’s Jake Holland for first alerting us to the development.
In Florida, SB 1734 was added to the Rules Committee agenda for April 6. It previously passed out of the Senate Commerce and Tourism Committee on March 22. No movement took place with its companion bill, HB 969, this week. Thanks to Joe Duball at the IAPP for keeping us up to date.
In Nevada, the Senate Committee on Commerce and Labor held a hearing on March 31 on SB260. No action was taken on the bill at the hearing. According to MLex’s Amy Miller, a proposed amendment will be forthcoming.
In Rhode Island, on March 29, the House Committee on Corporations held a hearing on House Bill 5959 and recommended that it be held for further study.
Finally, in Kentucky, the legislature closed its session on March 30 without passing its proposed bill. As a result, we have moved Kentucky into our “dead bills” category.
To date, state lawmakers have introduced bills in 24 states. Alaska, Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington are considering multiple bills. One state (Virginia) has passed legislation whereas the bills in four states (Kentucky, North Dakota, Mississippi, and Utah) have failed.
The below analysis divides the bills into four categories: (1) passed bills, (2) active bills, (3) introduced bills, and (4) dead bills.
Passed bills are those that have become law (i.e., Virginia). Active bills are those that have seen some movement, such as a committee hearing or vote. Introduced bills are those that have been introduced in a state legislature but have yet to see any movement (other than, for example, being referred to a committee). Dead bills are (as you might have guessed) bills that have failed.
For links to all of these bills please see our 2021 State Privacy Law Tracker.
On March 2, 2021, Virginia became the second state – after California – to enact state consumer data privacy legislation. You can find our coverage of the Virginia bill here, and you can find the text of the new law here. We also hosted a webinar on the law on March 11. You can access the recording here.
As discussed, the House Committee on Appropriations passed the Washington Privacy Act (WPA) out of committee last week. The WPA is now referred to Rules 2 Review. The Washington Senate previously passed the 2021 version of the WPA on March 3. The last day to pass opposite house bills is April 11. The Washington legislative session closes on April 25.
The People’s Privacy Act (a competing bill supported by the ACLU of Washington) has not seen movement since February 1. The deadline to pass bills out of their house of origin passed on March 9.
As discussed, the Oklahoma Computer Data Privacy Act appears to be stalled in committee.
SB 893, which is similar to Virginia’s Consumer Data Protection Act, was filed with the Legislative Commissioner’s Office on March 23 after the General Law Committee voted 18-0-2 on a joint favorable substitute. On April 1, the bill was referred to the Office of Legislative Research and Office of Fiscal Analysis.
Senate Bill 156, a one-paragraph bill, introduced on January 15 has not seen movement since the Joint General Law Committee held a public hearing on February 25.
The Connecticut legislature adjourns on June 9.
SB 1734 was added to the Rules Committee agenda for April 6. It previously passed out of the Senate Commerce and Tourism Committee on March 22.
A companion bill, HB 969, passed unanimously out of the Civil Justice & Property Rights Subcommittee on March 23. As reported in our prior post, the bill previously passed out of the Regulatory Reform Subcommittee. The bill is now with the Commerce Committee.
The Florida legislature adjourns on April 30.
Illinois is considering two bills.
First, HB 2404 (the Right to Know Act) is presently assigned to the Rules Committee. It had previously been assigned to the Cybersecurity, Data Analytics, & IT Committee. As its name suggests, the Right to Know Act would provide Illinois residents with the right to know certain information regarding their personal information.
In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (entitled the Consumer Privacy Act) on February 22. That bill was assigned to the Judiciary – Civil Committee on March 16, to the Civil Procedure & Tort Liability Subcommittee on March 23 and re-referred to the Rules Committee on March 27. HB 3910 is a modified version of the CCPA.
On March 15, the Assembly Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283, and A3255). A recording of the hearing is available here.
House Bill 216 was introduced on February 2, 2021. Notably, the bill has attracted 18 Republican sponsors or co-sponsors. However, to date, it has not moved forward and is currently referred to the House committee on Technology and Research. The bill is similar to the CCPA. The Alabama legislature adjourns on May 30.
SB 116 and HB 159 were introduced on March 31. Both bills are in committee. The Alaska legislature adjourns on May 19.
HB 2865 was introduced on February 11, 2021. To date, there have been no hearings or votes taken on the bill. The bill is currently pending in the House Commerce Committee. The bill does not readily track the form or contents of either the CCPA or the Virginia and Washington bills. The Arizona legislature adjourns on April 24.
SB21-190 was introduced on March 19, 2021. It was assigned to the Senate Committee on Business, Labor and Technology. You can read our analysis of the bill here. According to the legislative calendar, the deadline for bills to pass out of the Senate is April 7.
SB 930 (the Maryland Online Consumer Protection Act) was introduced on February 10, 2021. No action has been taken to date. The bill is a modified version of the CCPA. The Maryland legislature adjourns on April 12.
SD 1726 was filed on February 18, 2021. It does not appear that any action has been taken on the bill to date. The bill is a modified version of Washington’s People’s Privacy Act. A second bill, HD 3847, was filed in the state house.
Minnesota is considering two bills – HF 36 and HF 1492 / SF 1408. The bills have not seen movement since being introduced.
HF 36 is a modified (and shortened) version of the CCPA and contains a private right of action. HF 1492 / SF 1408 are similar to the Washington and Virginia bills.
The Minnesota legislature adjourns on May 17.
On March 17, 2021, Nevada lawmakers introduced AB323 and SB260. Although the bills are focused on adding a new “data broker” category to Nevada’s online disclosure law, they also would broaden Nevada’s definition of “sale” in its right to opt out of sales. The Senate Committee on Commerce and Labor held a hearing on SB 260 on March 31, and it appears an amendment is forthcoming. For more information, see our analysis here.
The Nevada legislature adjourns on June 1.
As shown on our tracker, New York legislators have proposed a number of consumer privacy bills in 2021. All of those bills currently sit in committee. However, according to Joe Duball and Joseph Jerome, the Governor’s budget proposal no longer contains privacy provisions.
H 3063 was pre-filed on December 9, 2020 and referred to the Committee on Labor on January 12, 2021. It has not moved since. The bill is limited to providing rights around the collection and use of biometric information. The South Carolina legislature adjourns on May 13.
In Texas, Representative Capriglione filed six bills “related to increasing the protection of consumer data by the private sector.” One bill, HB 3741, is a data privacy omnibus bill. As introduced, the bill is perhaps best described as a heavily modified version of the CCPA, however, there are many aspects of the bill that make it unique, including its creation of three “categories” of data. On March 22, the bill was referred to the House Committee for Business & Industry. The Texas legislature adjourns on May 31.
H.160 is still a short form bill (i.e., only one paragraph long). The bill has been referred to committee and no further action has been taken to date. The Vermont legislature adjourns on May 28.
Lawmakers introduced HB 3159 on March 15, 2021. The bill was referred to the House Judiciary Committee. It is similar to the CCPA. The West Virginia legislature adjourns on April 10.
Kentucky’s HB 408, North Dakota’s HB 1330, Mississippi’s Senate Bill 2612, and Utah’s SB 200 have all died.