Before 2018, no state in the US had its own data privacy law. Since 2018, California, Virginia (effective January 1, 2023), and Colorado (effective July 1, 2023) have all enacted their own data privacy laws, seeking to protect consumers by giving them control over their personal information. Recently, Ohio introduced House Bill 376, "The Ohio Personal Privacy Act," in July 2021, which does not have an effective date at this time. Now, Indiana has introduced  Senate Bill 358 and is ready to join the ever-growing Privacy Party.

Introduced in January 2022, Senate Bill 358 sets forth numerous consumer data protection standards, including Indiana consumers' rights to their personal data, the responsibilities on businesses and service providers (called "controllers" and "processors," respectively) to protect such data, and the authority of the Indiana Attorney General to investigate and enforce violations of the new law. If the bill is passed, it will go into effect on January 1, 2025.

Interestingly, when Senate Bill 358 was introduced early last month, it mirrored the California Privacy Rights Act (CPRA) and even contained a private right of action –allowing aggrieved individuals to sue companies for violating the law. However, the bill was amended prior to passing the Senate, and now aligns more with the Virginia Consumer Data Protection Act (VCDPA). Under the Virginia law, only the attorney general can enforce penalties on businesses for violating the VCDPA. In other words, there is no private right of action. The most recent version of Senate Bill 358:

  • Applies to controllers or processors that process the personal data of at least 100,000 consumers or processes the personal data of 25,000 consumers and derives 50% of its revenue from the sale of personal data;
  • Does not contain a private right of action;
  • Allows the Indiana Attorney General to initiate an action against controllers for any violations; and
  • Provides Indiana resides with rights to their data, including: Access, Correction, Deletion, Portability, and Opting Out of Processing.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.