Keypoint: This week legislatures in Florida, Washington, West Virginia and Wisconsin closed without passing bills while Maryland's bill was converted into a one-year study.
Below is our ninth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide two reminders.
First, we regularly update our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What's New?
- Upcoming Hearings
- CCPA-Like Privacy Bills
- VCDPA Amendments
- Biometric Privacy Bills
- Data Broker Bills
- Other Bills
1. What's New?
The story this week is the number of bills that died. The legislatures in Florida, Washington, West Virginia, and Wisconsin adjourned without passing bills, and Indiana's legislature will close on Monday, March 14, 2022, without passing a bill. The failure of bills in Florida, Indiana and Wisconsin is particularly notable given that bills in those states passed one chamber.
In Maryland, SB11 was replaced by a work group study bill. The bill was considered in two Senate Finance Committee voting sessions this week. During second session on March 11, 2022, the Committee voted to pass an amended bill that seeks to establish a work group study with a report to the General Assembly due by December 1, 2022.
Conversely, we did see movement on a few bills.
In Iowa, lawmakers proposed two amendments to HF 2506. That bill remains on the House floor calendar.
In Rhode Island, Representative McNamara introduced HB7917 - the Rhode Island Information Privacy Act.
In Tennessee, we obtained a copy of HB 1467 / SB 1554 from Representative Johnny Garrett. It appears we may see movement in that state soon.
In Oklahoma, Representative Walke confirmed to us on LinkedIn that HB1602 is dead but that he has secured a Senate author for HB2969, which is a prerequisite to getting the floor hearing.
Finally, the Virginia legislature adjourned on March 12, 2022, without any further movement on the VCDPA amendment bills. We provide an overview of the four bills that passed below.
2. Upcoming Hearings
March 18, 2022
Public hearing on Alaska's HB 159 in House Judiciary Committee.
Please note that many hearings are scheduled on short notice, and it is possible that more hearings could be noticed and held this week.
3. CCPA-Like Privacy Bills
Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.
Alaska
Alaska lawmakers are considering three bills - HB 222, HB 159 and SB 116. On February 4, 2022, the Alaska House Labor & Commerce Committee voted HB 159 out of committee. The House Judiciary Committee held a hearing on February 7, 2022, and has scheduled another hearing for March 18, 2022.
Arizona
Representative DeGrazia filed HB2790.
Connecticut
Connecticut Senator James Maroney introduced SB 6 on February 23, 2022. On March 3, 2022, the Joint Committee on General Law held a nearly four-hour hearing. It is expected that Senator Maroney will file an amended version of the bill in the coming days.
District of Columbia
Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.
Florida
The Florida legislature closed on March 11, 2022, without passing a bill.
Georgia
Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
Hawaii
Hawaii lawmakers introduced four bills: HB 2051, HB2341, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022 and deferred the bill. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.
Indiana
The Indiana legislature will adjourn on March 14, 2022, without passing a bill.
Iowa
Lawmakers introduced HSB 674 and SF2208. On February 15, 2022, the Iowa House Information Technology Committee voted 15-0 for favorable recommendation of HSB 674. The bill was subsequently introduced under a different number - HF 2506 - and placed on the calendar. On March 8 and 9, 2022, lawmakers filed two amendments. SF2208 was referred to a Commerce Committee subcommittee.
Kentucky
Senator Westerfield introduced SB 15 on January 13, 2022. On February 15, 2022, the Kentucky Senate Standing Committee on Economic Development, Tourism and Labor held an informational hearing on the bill.
On February 24, 2022, lawmakers introduced HB 586. The bill was referred to the Committee on Committees.
Maine
Senator Rafferty introduced LD 1982 on February 16, 2022. The bill was referred to the Innovation, Development, Economic Advancement and Business Committee. It was then referred to the Committee on Health Coverage, Insurance and Financial Services on March 9, 2022. On March 10, 2022, the Committee voted LB1982 as "ought not to pass."
Maryland
Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On March 11, the Senate Finance Committee amended the bill to establish a one-year work group study.
Massachusetts
The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. The bill is now filed under S.2687 (the Massachusetts Information Privacy and Security Act). On February 14, 2022, the bill was referred to the Senate Ways and Means Committee.
Minnesota
Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill.
Mississippi
SB 2330 died in committee.
Nebraska
Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission's model act. The Banking, Commerce and Insurance Committee held a hearing on February 28, 2022. No vote was taken.
New Jersey
New Jersey lawmakers filed three bills: S332, A505, and A1971.
New York
As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. On February 8, 2022, the New York Senate Consumer Affairs Committee voted S6701A out of committee. The bill was reported and committed to the Internet and Technology Committee.
North Carolina
In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.
Ohio
The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. On February 9, 2022, the Ohio House Government Oversight Committee voted the bill out of committee. On February 16, 2022, the status of the bill was changed to "informally passed." On February 22, 2022, the bill was re-referred to the Rules and Reference Committee.
Oklahoma
Oklahoma lawmakers are considering two bills.
HB 1602, which passed the Oklahoma House last year but stalled in the Senate, is officially dead as per Representative Walke's comments to us.
Representative Walke filed a second bill in 2022 - HB 2969. On February 16, 2022, HB 2969 passed the House Technology Committee. Prior to passing, a committee amendment was filed, striking the prior version of the bill and replacing it with a version nearly identical to HB 1602. According to Representative Walke, the difference between the two bills is that HB 2969 has a higher monetary threshold for applicability (annual gross revenues of $15 million instead of $10 million).
Finally, Oklahoma Representative O'Donnell introduced HB 3477. The bill is based on the Uniform Law Commission's model act.
Pennsylvania
Pennsylvania lawmakers are considering three bills.
HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.
In December 2021, lawmakers introduced a second bill - HB2202. That bill also was referred to the House Consumer Affairs Committee.
Finally, on January 20, 2022, lawmakers introduced a third bill - HB 2257 - which also was referred to the House Consumer Affairs Committee.
The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.
Rhode Island
Lawmakers introduced H7400 on February 9, 2022. The bill was referred to the House Innovation, Internet and Technology Committee.
Representative McNamara introduced HB7917 - the Rhode Island Information Privacy Act - on March 7, 2022. The bill was referred to the House Government & Elections Committee.
South Carolina
Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.
Tennessee
Lawmakers introduced HB 1467 / SB 1554.
Utah
Senator Cullimore introduced SB 227 on February 17, 2022. On February 25, 2022, the Utah Senate voted unanimously to pass the bill. The House unanimously passed a slightly amended version of the bill on March 3, 2022. The Senate concurred with the amendment the following day. The Senate President and House Speaker signed the bill, and it is currently in the enrollment process. The bill will next be sent to the Governor who will have 20 days from adjournment to sign the bill, not sign the bill (where it becomes law), or veto the bill. For further information on the UCPA see our blog post here.
Vermont
Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.
On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.
Washington
The Washington legislature closed on March 10, 2022, without passing a bill.
West Virginia
The West Virginia legislature closed on March 12, 2022, without passing a bill.
Wisconsin
The Wisconsin legislature closed on March 10, 2022, without passing a bill.
4. VCDPA Amendments
Virginia lawmakers passed four bills to amend the VCDPA prior to the March 12, 2022 adjournment date.
Lawmakers passed HB 381 and SB 393 on February 25, 2022 and March 4, 2022, respectively. The bills add the following new exemption to the VCDPA's right to delete:
A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data pursuant to subdivision A 3 by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the business's records and not using such retained data for any other purpose pursuant to the provisions of this chapter or (ii) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of this chapter.
Lawmakers also passed SB 534 and HB 714. The bills repeal the Consumer Privacy Fund and provide that all "civil penalties, expenses, and attorney fees collected pursuant to [the VCDPA] shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation and Enforcement Revolving Trust Fund."
The bills also amend the VCDPA's definition of "nonprofit organization" to include political organizations and any organization exempt from taxation under § 501(c)(4) of the Internal Revenue Code." The bills define political organization as "a party, committee, association, fund, or other organization, whether or not incorporated, organized and operated primarily for the purpose of influencing or attempting to influence the selection, nomination, election, or appointment of any individual to any federal, state, or local public office or office in a political organization or the election of a presidential/vice-presidential elector, whether or not such individual or elector is selected, nominated, elected, or appointed."
The Governor has until April 11, 2022 to act on HB381, SB393 and SB534. HB714 does not yet have an action deadline.
5. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills:
California
SB 1189 was introduced on February 18, 2022. It was referred to the Committees on Judiciary and Appropriation.
Kentucky
HB32 was introduced on January 4, 2022. The bill was withdrawn on February 28, 2022.
Maine
Lawmakers in Maine introduced LD 1945. The Judiciary Committee held a hearing on February 22, 2022 and a work session on March 2, 2022.
Maryland
Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House Economic Matters Committee held a hearing on February 2, 2022. The Senate Finance Committee held a hearing on February 9, 2022. No votes were taken.
Massachusetts
Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure. On February 14, 2022, the bill was incorporated into S.2687.
Missouri
HB 2716 was introduced on February 16, 2022.
New York
New York lawmakers are considering A27 and S1933. A27 was referred to the Assembly Consumer Affairs and Protection Committee. S1933 was referred to the Consumer Protection Committee.
West Virginia
The West Virginia legislature closed on March 12, 2022, without passing HB2064.
6. Data Broker Bills
Two states are considering bills to regulate data brokers:
Delaware
Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.
Massachusetts
Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee. The bill was incorporated into S.2687.
Oregon
The Oregon legislature closed on March 7, 2022, without lawmakers passing HB 4017.
Washington
The Washington legislature closed on March 10, 2022, without passing SB 5813.
7. Other Bills
Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.
In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 (HB3009) and a computer algorithm regulation bill (HB 3011). HB 3009 was referred to the House Technology Committee. HB 3011 was referred to the Rules Committee.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances./p>
