Chamber Comments on House Bill 380

The U.S. Chamber of Commerce (“Chamber”) believes that the Delaware Personal Data Privacy Act (“DPDPA”) strikes the right balance in providing data privacy protections for consumers while allowing for continued innovation. However, HB 380 would amend DPDPA and make it harder for consumers to obtain needed goods and services, restrict the ability of small businesses to compete, and impede innovation. HB 380 would cast Delaware as an outlier and reduce its competitiveness in retaining existing businesses and attracting new businesses seeking to locate or relocate to the state. Accordingly, the Chamber requests that you veto HB 380. Our concerns are listed in greater detail below.

I. Unnecessary Compliance Burdens

HB380 deviates from the Consensus State Approach, which has been adopted by over 20 states including Delaware and provides for new requirements for covered entities that do not create clear benefits to consumers. 65 percent of Delaware small businesses are worried about increased litigation and compliance costs associated with a state patchwork of laws.  HB380 would further a divergent state patchwork of privacy laws. 

For example, the bill requires covered businesses to compile and submit data protection assessments containing “an analysis of whether profiling poses any known or reasonably foreseeable heightened risk of harm to a consumer, and if so, a description of…the nature of the heightened risk of harm to a consumer.” This is duplicative of already existing data impact assessments in Delaware privacy law and there has not been a justifiable reason explained that current law fails to protect consumers.  

Additionally, HB 380 requires controllers responding to consumer requests to list each individual third-party they share personal data with instead of sharing the categories of third parties with whom they share data. It would also require controllers to make and share such lists before obtaining consent to transfer sensitive data. These measures create unnecessary compliance burdens with a high cost for businesses and reduce the competitiveness of Delaware’s business environment. 

II. Sale of Personal Data Definition

Most states follow the State Consensus Approach on privacy and define “sale of personal data” to exclude personal data disclosed to third parties to provide products or services the consumer expressly requests. HB 380 strays from the State Consensus Approach and would complicate compliance particularly for small businesses. The definition allows data transfers to be potentially classified as sales after the fact which creates significant regulatory uncertainty for businesses operating in the state.

Additionally, the “strictly necessary” standard for transfers involving sensitive data is technically complex and burdensome to comply with, as it would require determining every potential means of providing a consumer with a product or service and then deciding which ones require processing a given piece of data. 

III. Small Business Thresholds 

States that have data privacy laws have reduced burdens on small businesses by establishing reasonable data subject number or revenue percentage thresholds a company must exceed to be considered a covered entity. Accordingly, the DPDPA currently provides exemptions to businesses that process the personal data of 35,000 consumers or less or process the personal data of 10,000 consumers or less and derive 20% or less of their yearly revenue from the sale of personal data. 

However, HB 380 would drastically reduce these applicability thresholds to the personal data of 10,000 consumers or less, annually process the personal data of 5,000 consumers or less and derive 20% or less of their revenue from the sale of personal data, or is a third party that acquires personal data from a controller. The lowering of the DPDPA’s applicability thresholds will restrict the ability of small businesses in Delaware to compete with larger businesses and corporations. 

For the reasons stated above, we respectfully request that you veto HB 380 and maintain Delaware’s leadership on privacy and consumer protections. We look forward to working with you and the legislature on this critical issue.

Sincerely, 

Michael Blanco
Director, State and Local Policy
Chamber Technology Engagement Center
U.S. Chamber of Commerce

1. ^

    U.S. Chamber of Commerce, “Empowering Small Business,” (August 2025) available at https://www.uschamber.com/assets/documents/Empowering-Small-Business-Report-2025.pdf