Data Privacy

The U.S. Chamber supports a unified national data privacy framework to protect consumer data, promote transparency, and provide regulatory certainty in the marketplace.

Ensuring Business Innovation While Protecting
Consumer Privacy
 

Consumers deserve to have their privacy protected, and businesses need certainty to provide the best products and services, including those specifically designed to improve public health and promote economic recovery. Data knows no boundaries, as information constantly crosses state lines among hundreds of millions of Americans.

A patchwork of state privacy laws that employ differing or conflicting approaches threatens to hinder America’s technological leadership. Companies, particularly small businesses, would face unprecedented uncertainty as to which laws apply and how to comply with potentially conflicting laws. For consumers, confusion weakens an individual’s ability to exercise their rights.

That’s why the U.S. Chamber supports the passage of national privacy legislation that protects all Americans equally, and provides more assurance for consumers and businesses alike.

StateLegislation StatusShadingModel UsedModel DeviationTextBill TitleBill LinkBill TextBill Type
Alabama
Legislation Introduced in 2021
high
California Model
undefined
undefined
HB 216 (Lipscomb)
http://alisondb.legislature.state.al.us/Alison/default.aspx

"The Alabama Consumer Privacy Act" is effectively the CCPA.

House
Alaska
Legislation Introduced in 2021
high
California Model*
The Alaska Consumer Data Privacy Act mirrors the CCPA but includes a registry for data brokers and deems violations of the act as violations of the state's unfair and deceptive trade law. The House Labor and Commerce Committee held a hearing on the bill on May 17.
undefined
SB 116 (Senate Rules, Governor),HB 159 (House Rules, Governor)
https://www.akleg.gov/basis/Bill/Text/32?Hsid=SB0116A,https://www.akleg.gov/basis/Bill/Text/32?Hsid=HB0159A

The Alaska Consumer Data Privacy Act mirrors the CCPA but includes a registry for data brokers and deems violations of the act as violations of the state's unfair and deceptive trade law. The House Labor and Commerce Committee held a hearing on the bill on May 17.

,

The Alaska Consumer Data Privacy Act mirrors the CCPA but includes a registry for data brokers and deems violations of the act as violations of the state's unfair and deceptive trade law. The House Labor and Commerce Committee held a hearing on the bill on May 17.

Senate,House
Arizona
Considered Legislation in 2020
low
N/A
undefined
undefined
Arkansas
N/A
normal
N/A
undefined
undefined
California
N/A
normal
N/A
undefined
undefined
Colorado
Approved by Legislature, with Governor
super-extreme
Virginia Model*
The Colorado Privacy Act, although not verbatim, mirrors the Virginia model in terms of consumer rights and enforcement but includes provisions against unlawful discriminatory conduct. The bill passed the Senate Business, Labor & Technology Committee by 7 to 0 with amendments including global opt out, barring private rights of action, and some service provider issues. The Senate Appropriations Committee sent the bill to the Senate floor by a vote of 7 to 0.
undefined
SB 190 (Rodriguez)
https://legiscan.com/CO/drafts/SB190/2021

Although not verbatim, mirrors the Virginia model in terms of consumer rights and enforcement but includes provisions against unlawful discriminatory conduct. The bill passed the Senate Business, Labor & Technology Committee by 7 to 0 with amendments including global opt out, barring private rights of action, and some service provider issues. The Senate Appropriations Committee sent the bill to the Senate floor by a vote of 7 to 0. The bill passed the House 57 to 7 to 1 and the Senate 34 to 0 to 1.

Senate
Connecticut
Legislation Introduced in 2021
high
Virginia Model
undefined
SB 1202 (Looney),SB 893 (General Laws Committee),SB 156 (Duff),SB 723 (Hwang),HB 6169 (Vahey)
https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2021&bill_num=1202,https://www.cga.ct.gov/2021/TOB/S/PDF/2021SB-00893-R00-SB.PDF,https://www.cga.ct.gov/2021/TOB/S/PDF/2021SB-00156-R00-SB.PDF,https://www.cga.ct.gov/2021/TOB/S/PDF/2021SB-00723-R00-SB.PDF,https://www.cga.ct.gov/2021/TOB/H/PDF/2021HB-06169-R00-HB.PDF

This bill is Connecticut's budget bill. The Senate passed a version including a Virginia-like privacy bill that included a one-year cure period, exempted employee and business-to-business data, and barred private rights of action. The provision was inevitably stripped.

,

This bill is effectively the Virginia privacy approach. A public hearing was held about the bill on February 25. The General Law Committee passed out a substitute 18 to 0. The bill was passed favorably by a vote of 38 to 0 to 1 in the Joint Judiciary Committee.

,

This is a placeholder for a bill that would "(1) require businesses to disclose the proposed use of any personal information, (2) give consumers the right to discover what personal information such business possess and to opt out of the sale of such information, and (3) create a cause of action and penalties for violations of such requirements."

,

This bill is a placeholder bill for social media privacy.

,

This bill would establish a state data privacy task force.

Senate,Senate,Senate,Senate,House
Delaware
Considered Legislation in 2020
low
N/A
undefined
undefined
Florida
Legislation Passed a Chamber of Legislature
mid
California Model*
This bill is like the CCPA but it does go beyond it in some ways. It requires companies to not retain data for longer than what is needed to fulfill its initial purpose. It also includes correction rights and expands opt out from mere sales to sharing. Like CCPA, it allows a private right of action for data breach/unauthorized access but leaves remaining enforcement to the Department of Legal Affairs.
HB 969 (McFarland),SB 1734 (Bradley)
https://www.flsenate.gov/Session/Bill/2021/969/BillText/c1/PDF,https://www.flsenate.gov/Session/Bill/2021/1734/BillText/Filed/PDF

This bill was reported out of the Regulatory Reform Subcommittee. This bill was amended with a Committee Substitute including a private right of action for violations of privacy rights by the House Civil Justice and Property Rights Subcommittee. Most recently, the House Commerce Committee passed a striker bill that still included a private right of action. The full Senate then passed a striker amendment stripping the previous amendment of a private right of action and provided for a GLBA entity carve out by a vote of 29 to 11.

,

Although similar to the HB 969, this legislation would provide an opt out of sales—not sharing—right but has a private right of action that pertains to all violations of the Act. This bill passed out of the Commerce and Tourism Committee by a vote of 10 to 1. The Senate Rules Committee amended the bill removing the private right of action as part of a striker amendment. The Florida privacy bills failed to pass in 2021 as time in the legislative session ran out.

House,Senate
Georgia
N/A
normal
N/A
undefined
undefined
Hawaii
Legislation Introduced in 2021
high
Hawaii Model
undefined
undefined
SB 1009 (Lee)
https://www.capitol.hawaii.gov/session2021/bills/SB1009_.pdf

This bill would ban the sale of geolocation and internet browser history without opt-in consent. The legislation also deals with how government entities may obtain personal information in electronic communications. Such violations would be an unfair or deceptive trade practice. On February 16, the Government Operations Committee deferred the measure.

Senate
Idaho
N/A
normal
N/A
undefined
undefined
Illinois
Legislation Introduced in 2021
high
California Model
undefined
undefined
HB 3910 (Mussman),HB 2404 (Bucker),HB 2880 (Mazzochi)
https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=110&GA=102&DocTypeId=HB&DocNum=3910&GAID=16&LegID=132996&SpecSess=&Session=,https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=110&GA=102&DocTypeId=HB&DocNum=2404&GAID=16&LegID=131162&SpecSess=&Session=,https://www.ilga.gov/legislation/fulltext.asp?DocName=&SessionId=110&GA=102&DocTypeId=HB&DocNum=2880&GAID=16&LegID=131769&SpecSess=&Session=

The Consumer Privacy Act follows the CCPA model.

,

The Right to Know Act would require companies to disclose information sharing practices and have in place a data protection safety plan. Violations would be enforceable by a private right of action.

,

This bill would give consumer an intellectual property right in their digital identity.

House,House,House
Indiana
N/A
normal
N/A
undefined
undefined
Iowa
N/A
normal
N/A
undefined
undefined
Kansas
N/A
normal
N/A
undefined
undefined
Kentucky
Legislation Introduced in 2021
high
California Model*
This bill is like CCPA in that it gives consumers the right to transparency and opt out of data sales. It also requires opt-in for certain children's data.
undefined
HB 408 (Willner)
https://apps.legislature.ky.gov/recorddocuments/bill/21RS/hb408/orig_bill.pdf

It bans discrimination against those exercising data rights and would be enforced by the Attorney General. There is no deletion right.

House
Louisiana
N/A
normal
N/A
undefined
undefined
SR 188 (Reese)
https://www.legis.la.gov/legis/ViewDocument.aspx?d=1232132

Louisiana enacted a resolution requiring a study of buying, selling and usage of consumer data and other state laws like Virginia.

Maine
Considered Legislation in 2020
low
N/A
undefined
undefined
Maryland
Legislation Introduced in 2021
high
California Model*
While this state legislation follows the basic model, it does have some differences like deletion or opt-in rights.
undefined
Massachusetts
Legislation Introduced in 2021
high
Fiduciary Model*
While this state legislation follows the basic model, it does have some differences like deletion or opt-in rights.
undefined
HD 2664 (Vargas),SD 1726 (Creem)
https://malegislature.gov/Bills/192/HD2664,https://malegislature.gov/Bills/192/SD1726

The Massachusetts Information Privacy Act would impose a duty of loyalty, confidentiality, and care on covered entities with regard to personal information. It would also give consumers the rights of access, correction, data portability, and deletion. Covered entities are required to give notice. Consumers are to give consent before collection, disclosure and processing of data. The bill would create the Massachusetts Information Privacy Act Commission as the government regulator and enforcer and also enables a private right of action.

,

The Massachusetts Information Privacy Act would impose a duty of loyalty, confidentiality, and care on covered entities with regard to personal information. It would also give consumers the rights of access, correction, data portability, and deletion. Covered entities are required to give notice. Consumers are to give consent before collection, disclosure and processing of data. The bill would create the Massachusetts Information Privacy Act Commission as the government regulator and enforcer and also enables a private right of action.

House,Senate
Michigan
N/A
normal
N/A
undefined
undefined
Minnesota
Legislation Introduced in 2021
high
Virginia Model*
The Minnesota Consumer Data Privacy Act follows the Virginia model with a key exception in that it has more in depth anti-discrimination requirements, including a CCPA-like provision for taking action against consumers exercising privacy rights.
undefined
HF 1492 (Elkins),SF 1408 (Bigham),HF 36 (Noor)
https://www.revisor.mn.gov/bills/text.php?number=HF1492&type=bill&version=0&session=ls92&session_year=2021&session_number=0,https://www.revisor.mn.gov/bills/text.php?number=SF1408&version=latest&session=ls92&session_year=2021&session_number=0,http://wdoc.house.leg.state.mn.us/leg/LS92/HF0036.0.pdf

The Minnesota Consumer Data Privacy Act follows the Virginia model with a key exception in that it has more in depth anti-discrimination requirements, including a CCPA-like provision for taking action against consumers exercising privacy rights.

,

The Minnesota Consumer Data Privacy Act follows the Virginia model with a key exception in that it has more in depth anti-discrimination requirements, including a CCPA-like provision for taking action against consumers exercising privacy rights.

,

This bill is effectively the CCPA with some changes and a private right of action.

House,Senate,House
Mississippi
Legislation Introduced in 2021
high
California Model
undefined
undefined
SB 2612 (Turner-Ford)
http://billstatus.ls.state.ms.us/documents/2021/pdf/SB/2600-2699/SB2612IN.pdf

The "Mississippi Consumer Data Privacy Act" is effectively the CCPA. This bill died in Committee on February 2.

Senate
Missouri
N/A
normal
N/A
undefined
undefined
Montana
Legislation Introduced in 2021
high
Transparency Model
undefined
undefined
HB 710 (Olsen)
https://leg.mt.gov/bills/2021/billpdf/HB0710.pdf

This bill would require online operators to provide notice about the collection and use of data as well as how the operator responds to opt-out and correction requests.

House
Nebraska
Considered Legislation in 2020
low
N/A
undefined
undefined
Nevada
N/A
normal
N/A
undefined
undefined
SB 260 (Cannizzaro)
https://www.leg.state.nv.us/App/NELIS/REL/81st2021/Bill/7805/Overview

This bill, which was signed by the Governor, expands the requirements of current Nevada law allowing opt out of online data sales to data brokers who primary purpose is buying and selling data.

New Hampshire
Considered Legislation in 2020
low
N/A
undefined
undefined
New Jersey
Legislation Introduced in 2021
high
Washington/California Model
undefined
undefined
A 3255 (Buzrichelli),A 3283 (Zwicker),S 1257 (Singleton)
https://www.njleg.state.nj.us/2020/Bills/A3500/3255_I1.PDF,https://www.njleg.state.nj.us/2020/Bills/A3500/3283_I1.PDF,https://www.njleg.state.nj.us/2020/Bills/S1500/1257_I1.PDF

This bill, mirroring CCPA in many ways, would require companies to get opt-in consent before collecting and sharing personally identifiable information. Consumers also would enjoy transparency, access and deletion rights. Additionally companies would be barred from discriminating against consumers for exercising rights.

,

The New Jersey Disclosure and Accountability Act or NJ DaTA Act would bar the processing of personal information unless there is an enumerated legitimate interest or there is opt-in consent. The bill also provides for security requirements in addition to access, correction, and transparency rights. Individuals also have the right to object to processing in certain circumstances.

,

This bill would require commercial internet website operators and online serves to provide transparency about the use, collection, and sharing of personal information. It also would require operators to honor opt out requests to be provided in a manner chosen by the operator.

House,House,Senate
New Mexico
Considered Legislation in 2020
low
N/A
undefined
undefined
New York
Legislation Introduced in 2021
high
Fiduciary Model, Bill of Rights
undefined
S6701 (Thomas),A3005 (Finance),S2505 (Finance),A680 (Rosenthal),A405 (Rosen),S567 (Hoylman),A400 (Rozic),S1349 (Hoylman),S1570 (Sanders),A3586 (Kim),S4021 (Comrie),A5091 (Reilly),S5003 (Parker),A6042 (Cruz),S6727 (Gounardes)
https://legislation.nysenate.gov/pdf/bills/2021/S6701,https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=A03005&term=2021&Summary=Y&Text=Y,https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S02505&term=2021&Summary=Y&Text=Y,https://nyassembly.gov/leg/?default_fld=%0D%0A&leg_video=&bn=a680&term=2021&Summary=Y&Text=Y#jump_to_Text,https://nyassembly.gov/leg/?default_fld=%0D%0A&leg_video=&bn=a405&term=2021&Summary=Y&Text=Y#jump_to_Text,https://nyassembly.gov/leg/?default_fld=%0D%0A&leg_video=&bn=s567&term=2021&Summary=Y&Text=Y#jump_to_Text,https://nyassembly.gov/leg/?default_fld=%0D%0A&leg_video=&bn=A00400&term=2021&Summary=Y&Text=Y#jump_to_Text,https://www.nysenate.gov/legislation/bills/2021/s1349,https://legiscan.com/NY/text/S01570/id/2240243/New_York-2021-S01570-Introduced.html,https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=A03586&term=2021&Summary=Y&Text=Y,https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=S04021&term=2021&Summary=Y&Text=Y,https://legislation.nysenate.gov/pdf/bills/2021/A5091,https://www.nysenate.gov/legislation/bills/2021/S5003https://www.nysenate.gov/legislation/bills/2021/S5003,https://nyassembly.gov/leg/?default_fld=&leg_video=&bn=A06042&term=2021&Summary=Y&Text=Y,https://www.nysenate.gov/legislation/bills/2021/s6727

The "New York Privacy Act" would give consumers the right to notice, opt-in for data processing, access, portability, correction, and deletion rights. The bill would give consumers the right to appeal automated decision-making in the financial services, housing, public accommodation, insurance and health care services. Consumers cannot be discriminated against for failure to opt in. The bill would be enforced by the Attorney General and private rights of action.

,

The "New York Data Accountability and Transparency Act" would task the Secretary of State through rulemaking to develop a Privacy Bill of Rights including but not limited to the right to data protection, access, correction, deletion, control, and opting out of sales. A new Data Privacy Advisory Board would provide guidance. Both bills have been recommitted to their respective finance committees.

,

The "New York Data Accountability and Transparency Act" would task the Secretary of State through rulemaking to develop a Privacy Bill of Rights including but not limited to the right to data protection, access, correction, deletion, control, and opting out of sales. A new Data Privacy Advisory Board would provide guidance. Both bills have been recommitted to their respective finance committees.

,

The New York Privacy Act which effectively is the same as last year including the fiduciary duty, transparency, portability, correction, and deletion rights. This bill has a private right of action.

,

The Online Consumer Protection Act would prohibit collection by webpage publishers and advertising networks from collecting personal information for purposes of "online preference marketing" unless there is consent.

,

This bill would give consumers the right to know about data practices and give them the right to opt out of data sales.

,

The "Right to Know Act" would provide consumers with the ability to request how companies collect, use, and share personal information.

,

The "Right to Know Act" would provide consumers with the ability to request how companies collect, use, and share personal information.

,

This "New York Data Protection Act" would give individuals the right among others things access and deletion rights to personal information held by government entities and their contractors.

,

The "It's Your Data Act" would make it a misdemeanor for companies that collect, store, or use data for trade, advertising, data-mining, or commercial or economic value certain personal data without consent or if they fail to act with reasonable care as a bailee of the data even with consent. The bill would also require transparency, collection limitation, deletion and access rights. The bill would prohibit discrimination like CCPA for exercising privacy rights and companies are required to maintain reasonable security. The bill includes a private right of action.

,

The "It's Your Data Act" would make it a misdemeanor for companies that collect, store, or use data for trade, advertising, data-mining, or commercial or economic value certain personal data without consent or if they fail to act with reasonable care as a bailee of the data even with consent. The bill would also require transparency, collection limitation, deletion and access rights. The bill would prohibit discrimination like CCPA for exercising privacy rights and companies are required to maintain reasonable security. The bill includes a private right of action.

,

This bill will make it a Class E felony to release certain personal data without authorization.

,

This bill would enact a New York constitutional right to privacy.

,

The Digital Fairness Act would require privacy notices and opt-in consent for data processing.

,

The Data Labor Compensation Act would establish and Office of Consumer Data Protection and a Board which oversees and regulates data privacy in New York. The aim of the bill is also to tax gross receipts from companies that earn a profit using data.

Senate,House,Senate,House,House,Senate,House,Senate,Senate,House,Senate,House,Senate,House,Senate
North Carolina
Legislation Introduced in 2021
high
Virginia Model*
The Consumer Privacy Act of North Carolina mirrors the Virginia model substantively but in addition to Attorney General enforcement, it provides for a private right of action for both injunctive relief and damages.
undefined
S 569 (Salvador)
https://webservices.ncleg.gov/ViewBillDocument/2021/2538/0/DRS15222-LR-88A

The Consumer Privacy Act of North Carolina mirrors the Virginia model substantively but in addition to Attorney General enforcement, it provides for a private right of action for both injunctive relief and damages.

Senate
North Dakota
Legislation Introduced in 2021
high
North Dakota Model
undefined
undefined
HB 1330 (Kading)
https://www.legis.nd.gov/assembly/67-2021/documents/21-0816-02000.pdf

This bill would require covered entities to obtain opt-in consent before selling personal information. The bill specifically authorizes class action lawsuits. The House Industry, Business & Labor Committee held a public hearing on the bill on February 9, 2021 and voted "Do Not Pass" 12 to 1 to 1. The full House voted against the bill 75 to 19.

House
Ohio
N/A
normal
N/A
undefined
undefined
Oklahoma
Legislation Passed a Chamber of Legislature
mid
California Model*
The "Oklahoma Consumer Data Privacy Act" is effectively the CCPA but with opt-in for data sales, and not opt-out like CCPA.
undefined
HB 1602 (Walke),HB 1130 (Phillips),HB 1125 (Phillips)
http://webserver1.lsb.state.ok.us/cf_pdf/2021-22%20ENGR/hB/HB1602%20ENGR.PDF,https://app.leg.wa.gov/committeeschedules/Home/Documents/28245?/Senate/28240/01-01-2021/12-31-2021/Schedule/5062//Bill/,http://webserver1.lsb.state.ok.us/cf_pdf/2021-22%20ENGR/hB/HB1125%20ENGR.PDF

The original bill had a private right of action but would now be enforced by the Attorney General alone. The House passed the bill 85 to 11.

,

This bill would impose transparency and notice requirements concerning personal information.

,

This bill would subject companies that do not fulfill privacy promises to be deemed in violation of Oklahoma's Consumer Protect Act. This bill passed the House 91 to 0.

House,House,House
Oregon
Considered Legislation in 2020
low
N/A
undefined
undefined
Pennsylvania
Legislation Introduced in 2021
high
California Model
undefined
undefined
HB 1126 (Nielson)
https://www.legis.state.pa.us/CFDOCS/Legis/PN/Public/btCheck.cfm?txtType=PDF&sessYr=2021&sessInd=0&billBody=H&billTyp=B&billNbr=1126&pn=1174

The Consumer Data Privacy Act is effectively the CCPA.

House
Rhode Island
Legislation Introduced in 2021
high
Transparency Model
undefined
undefined
H 5959 (Shanley)
http://webserver.rilin.state.ri.us/BillText21/HouseText21/H5959.pdf

The Rhode Island Transparency and Privacy Protection Act would require online operators to provide notice of data practices. The measure was recommended to be held for further study by Committee.

House
South Carolina
N/A
normal
N/A
undefined
undefined
South Dakota
N/A
normal
N/A
undefined
undefined
Tennessee
N/A
normal
N/A
undefined
undefined
Texas
Legislation Introduced in 2021
high
Texas Model
undefined
undefined
HB 3741 (Capriglione)
https://capitol.texas.gov/tlodocs/87R/billtext/pdf/HB03741I.pdf#navpanes=0

This bill would give consumers the right to know how data is used, collected and shared. Additionally, consumers would have the right to correction, access, and portability as well as deletion of sensitive personal information. Consumers and businesses may contract with data as consideration for goods and services reasonably related to the value of the data. The legislation would create restrictions on the sharing of personal information based on tiers associated with risk. After a consumer closes an account with a business, the business must delete all personal information within 1 year. The Act would be enforced by the Attorney General and bars private rights of action.

House
Utah
Legislation Introduced in 2021
high
Virginia Model*
The Utah Commercial Privacy Act, although not identical, tracks the Virginia model conceptually, with regard to consumer rights but has several differences like a longer time period to respond to consumer requests.
undefined
SB 200 (Kirk)
https://le.utah.gov/~2021/bills/sbillint/SB0200.pdf

The Utah Commercial Privacy Act, although not identical, tracks the Virginia model conceptually, with regard to consumer rights but has several differences like a longer time period to respond to consumer requests. This bill failed to get past the Third Reading in the Senate and has failed.

Senate
Vermont
Legislation Introduced in 2021
high
California Model
undefined
undefined
H 160 (Townsend)
https://legislature.vermont.gov/Documents/2022/Docs/BILLS/H-0160/H-0160%20As%20Introduced.pdf

A placeholder bill that gives consumers the same rights as CCPA.

House
Virginia
Bill signed into law
extreme
Virginia Model
undefined
undefined
HB 2307 (Hayes),SB 1392 (Marsden),SB 641 (Surovell),HB 473 (Sickles)
https://lis.virginia.gov/cgi-bin/legp604.exe?212+ful+HB2307S1+pdf,https://lis.virginia.gov/cgi-bin/legp604.exe?ses=212&typ=bil&val=sb1392,https://lis.virginia.gov/cgi-bin/legp604.exe?211+ful+SB641+pdf,https://lis.virginia.gov/cgi-bin/legp604.exe?211+ful+HB473+pdf

The Consumer Data Protection Act, mirroring the Washington State model, with access, correction, deletion, portability, opt out rights, and opt in rights for sensitive data to be enforced solely by the state AG. Governor Ralph Northam signed the bill into law on March 2 making it the second general data privacy law in the country.

,

The Consumer Data Protection Act, mirroring the Washington State model, with access, correction, deletion, portability, opt out rights, and opt in rights for sensitive data to be enforced solely by the state AG. Governor Ralph Northam signed the bill into law on March 2 making it the second general data privacy law in the country.

,

Carried over from last year, this bill would create a private right of action against "data sellers" who fail to implement reasonable security, obtain express consent for minor's data, access procedures, provide a "Do Not Sell" option, or maintaining or selling inaccurate information.

,

Carried over from last year, the Virginia Privacy Act is more like the Washington State model.

House,Senate,Senate,House
Washington
Legislation Passed a Chamber of Legislature
mid
Washington Model
undefined
undefined
HB 1433 (Kloba),SB 5108 (Erickson),SB 5062 (Carlyle)
http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/House%20Bills/1433.pdf?q=20210202091137,http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Bills/5108.pdf,http://lawfilesext.leg.wa.gov/biennium/2021-22/Pdf/Bills/Senate%20Bills/5062-S2.pdf?q=20210217071039

The "Peoples Privacy Act" would give consumers the right to access, transparency, refusal of consent for processing other than what essential for a transaction, correction, deletion, and "not to be subject to surreptitious surveillance." The bill would also impose notice requirements. The State Department of Commerce is tasked with rulemaking regarding notice. Discrimination based on age, race, creed, color, national origin, sexual orientation, gender identity, sex, disability, genetics or domestic violence status would be barred. A private right of action is authorized.

,

This legislation would requirement affirmative consent before companies can develop "secret surveillance scores."

,

The "Washington Privacy Act" would give consumers the right to access, correction, deletion, and opt out of processing data for targeted advertising, data sales, and profiling in furtherance of decisions producing a legal effect. Controllers must issue a privacy notice, limit collection and use, and maintain reasonable security. Controllers would also be required to implement data protection assessments. The Attorney General would be tasked with enforcement and the Act would not give rise to a new private right of action. The bill was passed 12 to 1 on to the Senate Ways & Means Committee, please click here. To view the Senate Ways & Means February 8, 2021 public hearing on the bill view here. The bill passed the Senate 48 to 1. On April 1, the House Appropriations voted to recommend passing a striker amendment adopted by the House Civil Rights & Judiciary Committee which includes an injunctive private right of action and global opt out.

House,Senate,Senate
West Virginia
Legislation Introduced in 2021
high
California Model*
This bill follows in the mold of the CCPA but does give consumers the right to data correct and the ability to opt out of data sharing in addition to data sales.
undefined
HB 3159 (Hamrick)
http://www.wvlegislature.gov/Bill_Status/bills_text.cfm?billdoc=HB3159%20INTR.htm&yr=2021&sesstype=RS&i=3159

This bill follows in the mold of the CCPA but does give consumers the right to data correct and the ability to opt out of data sharing in addition to data sales.

House
Wisconsin
Considered Legislation in 2020
low
N/A
undefined
undefined
Wyoming
N/A
normal
N/A
undefined
undefined

You can also download the data.

Tell Congress


The 10 Principles of Data Privacy

A Nationwide Privacy Framework

Consumers and businesses benefit when there is certainty and consistency with regard to regulations and enforcement of privacy protections. They lose when they have to navigate a confusing and inconsistent patchwork of state laws. While the United States already has a history of robust privacy protection, Congress should adopt a federal privacy framework that preempts state law on matters concerning data privacy in order to provide certainty and consistency to consumers and businesses alike.

Privacy Protections Should be Risk-Focused and Contextual

Privacy protections should be considered in light of the benefits provided and the risks presented by data. These protections should be based on the sensitivity of the data and informed by the purpose and context of its use and sharing. Likewise, data controls should match the risk associated with the data and be appropriate for the business environment in which it is used.

Transparency

Businesses should be transparent about the collection, use, and sharing of consumer data and provide consumers with clear privacy notices that businesses will honor.

Industry Neutrality

These principles apply to all industry sectors that handle consumer data and are not specific to any subset of industry sectors. These principles shall be applied consistently across all industry sectors. The United States Chamber of Commerce believes that consumers benefit from the responsible use of data. Technology and the data-driven economy serve as the twenty-first century’s great democratizer by empowering and enabling increased access to educational, entrepreneurial, health care, and employment opportunities for all Americans.

Flexibility

Technology evolves rapidly; laws and regulations should focus on achieving these privacy principles. Privacy laws and regulations should be flexible and not include mandates that require businesses to use specific technological solutions or other mechanisms to implement consumer protections. A federal privacy law should include safe harbors and other incentives to promote the development of adaptable, consumer-friendly privacy programs.

Harm-Focused Enforcement

Enforcement provisions of a federal data privacy law should only apply where there is concrete harm to individuals.

Enforcement Should Promote Efficient and Collaborative Compliance

Consumers and businesses benefit when businesses invest their resources in compliance programs designed to protect individual privacy. Congress should encourage collaboration as opposed to an adversarial enforcement system. A reasonable opportunity for businesses to cure deficiencies in their privacy compliance practices before government takes punitive action would encourage greater transparency and cooperation between businesses and regulators. In order to facilitate this collaboration, a federal privacy framework should not create a private right of action for privacy enforcement, which would divert company resources to litigation that does not protect consumers. Enforcement authority for a federal privacy law should belong solely to the appropriate state or federal regulator.

International Leadership

Congress should adopt policies that promote the free flow of data across international borders for consumer benefit, economic growth and trade. A national privacy framework will bolster continued U.S. leadership internationally and facilitate interoperable cross-border data transfer frameworks.

Encouraging Privacy Innovation

Incorporating privacy considerations into product and service design plays an important role and benefits all consumers. A national privacy framework should encourage stakeholders to recognize the importance of consumer privacy at every stage of the development of goods and services.

Data Security and Breach Notification

As part of a national privacy framework, Congress should include risk-based data security and breach notification provisions that protect sensitive personal information pertaining to individuals. Keeping this information secure is a top industry priority. Security is different for individual businesses and one-size-fits-all approaches are not effective; therefore, companies should have flexibility in determining reasonable security practices. Preemptive federal data security and breach notification requirements would provide consumers with consistent protections and would also reduce the complexity and costs associated with the compliance and enforcement issues resulting from different laws in the 50 states and U.S. territories.

Recent Activity

EventOct 19, 2021 - 12:00pm to 2:15pm
Legal Reform Summit 2021

Institute for Legal Reform Summit XXI: On The Horizon

Summit XXI: On the Horizon will explore timely issues including preserving due process in post-pandemic litigation, class and mass action trends in Europe, and emerging liability-expanding tactics.

Above the FoldSep 17, 2021 - 9:00am
FTC building

Congress Should Write Privacy Rules, Not the FTC

This week, President Biden nominated Alvaro Bedoya, privacy activist and head of Georgetown University’s Center on Privacy and Technology, to replace outgoing Federal Trade Commission (FTC) Commissioner Rohit Chopra.

Above the FoldJun 01, 2021 - 10:45am
Consumer data privacy

U.S. Businesses Face the Specter of Data Localization in Europe 

Without a new Privacy Shield, U.S. businesses face the specter of data localization in Europe.

Press ReleaseMar 29, 2021 - 10:00am

U.S. Chamber Announces State and Local Policy Initiative to Promote Effective State Policies

“From data privacy to worker classification to discriminatory taxes to energy regulation, increasingly, policy issues of significant importance to the business community are migrating from statehouse to state house and from the federal government to state governments and vice-versa," said Tom Wickham, Senior Vice President for State and Local Policy at the U.S. Chamber of Commerce. “Many of these policies have outsized impact on the national economy and even local governments are considering policies that have implications well beyond their borders. This new initiative will improve strategic coordination, collaboration, and information sharing to help advance pro-business policy and stop policy that undermines the free enterprise system and job creation, irrespective of where those policies are under consideration.

EventMar 16, 2021 - 2:00pm to 3:00pm
CTEC Event Digital Transformation: Modernizing Government for the Challenges Ahead

Digital Transformation: Modernizing Government for the Challenges Ahead

C_TEC will be setting the IT modernization agenda through high-level discussions with policymakers, industry leaders, and influencers.