.png)
Following in California’s footsteps with its California Consumer Privacy Act (CCPA), several other states either attempted (now stalled or failed) or are close to passing similar legislation to provide their residents with access to and control of their data.
Mississippi, North Dakota, Vermont, and South Carolina all had CCPA-styled bills that are now either dead or indefinitely stalled in committee. Kentucky, Maryland, Massachusetts, Illinois, and Florida all have bills in the early stages of submission at their respective state legislatures.
The following three states seem to have the most interesting, alive, and well-developed CCPA-styled legislation to date:
Virginia:
On February 24, 2021, the Virginia State Senate passed SB 1392, “Consumer Data Protection Act,” which seeks to establish “a framework for controlling and processing personal data in the Commonwealth.” The bill applies to all persons that conduct business in the Commonwealth and either (i) control or process personal data of at least 100,000 consumers or (ii) derive over 50 percent of gross revenue from the sale of personal data and control or process personal data of at least 25,000 consumers. SB 1392 exempts state or local governmental entities, as well as data gathered by federal law. Just like California, the bill grants consumers the right to access, correct, delete, and obtain a copy of personal data, and, in a nod to GDPR language, provides its residents the ability to opt out of the “processing” of personal data for the purposes of targeted advertising. All rights are enforced by the Attorney General’s office and the bill will have a delayed result: not becoming effective until January 1, 2023. This delay allows plenty of time for implementation. This legislation is awaiting the Governor’s signature.
Utah:
After finishing its third reading in front of the Utah Senate on February 26, 2021, S.B. 200, referred to as the “Utah Consumer Privacy Act and Utah Commercial Email Act,” waits for its next move inside the state legislature. Like other post-CCPA state legislative pieces, this bill gives Utah residents the right to know, access, correct, and delete personal data collected about them.
However, Utah adds restrictions on commercial uses of email by prohibiting advertisers from “knowingly” initiating or advertising, in a commercial email, sent from Utah or to a Utah email address, if (1) the commercial email contains or is accompanied by a third party's domain name without the permission of the third party; (2) the commercial email contains or is accompanied by false, misrepresented, or forged header information, even if the commercial email contains truthful identifying information for the advertiser in the body of the email; or (3) the commercial email has a subject line that is likely to mislead a recipient. Most surprisingly, this bill, as currently written, permits the Attorney General, the electronic mail service provider, the recipient of the offending email, and the domain name owner to bring claims against the offending advertises. If passed, Utah courts are about to get packed.
Oklahoma
Still pending before the Oklahoma state senate, HB 1602, the Oklahoma Computer Privacy Act was purportedly designed to be the “least restrictive alternative necessary to protect individuals and their rights.” In proposing the legislation, the Oklahoma drafters provide that “contracts or other agreements purporting to waive or limit a right, remedy or means of enforcement are contrary to public policy and are void.” Violators of this act may be subject to injunctive relief or civil penalties in an amount not to exceed $2,500 per violation for negligence offenses or $7,500 for intentional violations (a very Illinois-style penalty). Furthermore, the act authorizes the Oklahoma Corporation Commission to recover “reasonable expenses, including reasonable attorney fees, court costs and investigatory costs, incurred in obtaining injunctive relief or civil penalties, or both, under this section.” Any amounts recovered go to the state of Oklahoma’s General Revenue Fund. This is not a terrible idea for combatting any budget deficits.