Keypoint: It was another busy week with lawmakers introducing consumer privacy bills in Hawaii, Indiana, Massachusetts and New York, biometric privacy bills in Hawaii and New York, and a health data privacy bill in Massachusetts.
Below is the second weekly update on the status of proposed state privacy legislation in 2023. Before we get to our update, we wanted to provide two reminders.
First, as in past years, we will be regularly updating our State Privacy Law Tracker map with links to the consumer data privacy bills. We encourage you to bookmark the page for easy reference.
Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.
Table of Contents
- What’s New?
- Upcoming Hearings
- Consumer Data Privacy Bills
- Biometric Privacy Bills
- Data Broker Bills
- Children’s Privacy Bills
- Health Data Privacy Bills
- Automated Employment Decision Tools Bills
- Algorithmic Discrimination Bills
1. What’s New?
Lawmakers continued to introduce bills last week – a number of which have interesting backstories and potential implications.
Four states introduced consumer privacy bills – Massachusetts, Hawaii, Indiana, and New York.
In Massachusetts, lawmakers introduced two sets of competing bills.
The Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.
Meanwhile, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Fiengold and in the House (HD 3263) by Representative Daniel Carey.
The filing of the MDPPA by Stone Creem, Vargas and Rogers is interesting because, in 2022, they were the sponsors of the MIPSA bill (H.4514 / S.2687). However, that bill was significantly revised through the committee process. In fact, shortly after the committee revisions, Representatives Vargas and Rogers expressed their hesitation over the changes while appearing on our Data Privacy Unlocked Podcast.
In Hawaii, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110. Hawaiian lawmakers have pursued consumer privacy bills in prior years, including filing four bills last year, none of which gained momentum. Of interest, two of the four bill sponsors on SB1110 are also sponsors on SB 974.
In Indiana, Representative Chris Jeter filed HB 1554. Senator Liz Brown previously filed SB 5. HB 1554 is similar, but not identical, to SB 5 and includes additional provisions regarding data brokers and children. The introduction of the separate House bill this year is interesting given that, last year, the Indiana Senate passed Senator Brown’s privacy bill but it stalled in the House.
In New York, lawmakers refiled two bills that we tracked in 2022. On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). On January 19, 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). As we reported last week, New York Senator Kevin Thomas previously introduced the New York Privacy Act (S365).
Turning our attention to biometric privacy bills, there were three such bills and a companion bill filed this week.
A group of Hawaiian senators introduced the Hawaii Biometric Information Privacy Act (SB 1085) on January 20, 2023. Of note, four of the bill sponsors on this bill are also sponsors on SB 974 (discussed above).
Meanwhile, lawmakers introduced two biometric privacy bills in New York. On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). This BIPA-like bill would create a private right of action around the collection of biometric information. On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or other identified activities.
In addition, a group of thirteen Maryland senators cross-filed a biometric privacy bill (SB0335) in the Senate. Last week, a group of House members filed HB0033. Last year, the bill passed the House but failed in the Senate.
We also saw two companion health data privacy bills filed this week in Massachusetts – SD 2118 and HD 3855.
Finally, as discussed more in the next section, lawmakers have started scheduling hearings on some of the bills we are tracking. Last week, the Oregon Business and Labor Committee held a public hearing on HB 2052 (data brokers). No vote was taken.
2. Upcoming Hearings
January 23, 2023
Subcommittee meeting on Iowa House Study Bill 12
January 24, 2023
Public hearing on Washington HB1155 (health data privacy) in House Committee on Civil Rights and Judiciary
Hearing on Virginia SB 1432 (health records privacy) in Senate Subcommittee on Health
January 26, 2023
Hearing on Indiana SB 5 in Commerce and Technology Committee
January 27, 2023
Washington HB1155 (health data privacy) scheduled for executive session in House Committee on Civil Rights and Judiciary
3. Consumer Data Privacy Bills
The below states are considering consumer data privacy bills. These bills are also tracked on our 2023 State Privacy Law Tracker.
Hawaii
On January 20, 2023, lawmakers introduced two versions of the Hawaii Consumer Data Protection Act in the Senate – SB 974 and SB 1110.
Indiana
Republican Senator Liz Brown introduced SB 5 on January 9, 2023. The bill was referred to the Committee on Commerce and Technology. Last year, the Indiana Senate passed Senator Brown’s SB 358 but it did not make it out of the House.
On January 19, 2023, Representative Chris Jeter filed HB 1554. HB 1554 is similar, but not identical, to SB 5 and includes additional provisions regarding data brokers and children. The bill was assigned to the Committee on Commerce, Small Business and Economic Development.
Iowa
House Study Bill 12 was introduced on January 12, 2023. It was referred to the Economic Growth and Technology Committee and assigned to a three-member subcommittee. Last year, the Iowa House passed House File 2506 but it stalled in the Senate.
Kentucky
Republican Senator Whitney Westerfield introduced SB15 on January 5, 2023. The bill was referred to the Committee on Economic Development, Tourism and Labor. Last year, Senator Westerfield filed SB15.
Massachusetts
Massachusetts lawmakers have introduced two sets of competing bills.
First, on January 18 and 19, 2023, the Massachusetts Data Privacy Protection Act (MDPPA) was filed in both the Senate (SD 745) by Senator Cynthia Stone Creem and in the House (HD2281) by Representatives Andres Vargas and David Rogers. That bill is based on the federal American Data Privacy Protection Act with additional provisions relating to workplace surveillance.
Second, on January 20, 2023, the Massachusetts Information Privacy and Security Act (MIPSA) was introduced in both the Senate (SD1971) by Senator Barry Fiengold and in the House (HD 3263) by Representative Daniel Carey.
Mississippi
Democrat Senator Angela Turner-Ford introduced SB 2080 on January 9, 2023. The bill was referred to the Judiciary Committee. Last year, Senator Turner-Ford introduced SB 2330.
New Jersey
Three bills that we tracked last year have carried over to the 2023 session –S332, A505, and A1971. The bills remain in committee. These bills are not as broad as the other bills discussed in this section.
New York
On January 4, 2023, Democrat Senator Kevin Thomas introduced S365. The bill was referred to the Consumer Protection Committee. Senator Thomas introduced S6701 last year. On January 9, 2023, lawmakers also introduced A417, which would create consumer rights around access to and transfers of personal information. The bill was referred to the Consumer Affairs and Protection Committee.
On January 17, 2023, a group of lawmakers introduced the Online Consumer Protection Act (A1366). The bill was referred to the Consumer Affairs and Protection Committee. On January 19 2023, Senator Brian Kavanagh introduced the Digital Fairness Act (SB2277). The bill was referred to the Internet and Technology Committee. Both of the bills were filed in 2022.
Oklahoma
Republican Representative Josh West pre-filed HB 1030 – the Oklahoma Computer Data Privacy Act (OCDPA). The Oklahoma legislature will open February 6, 2023. Representative West filed privacy legislation the last two years with the bills passing the House but not the Senate. In previous years, the bills were co-sponsored by Collin Walke who retired from the House. As in prior years, the hallmark of the OCDPA is that it would require consumer consent for all personal data collection.
Oregon
Democrat Senator Floyd Prozanski and Democrat Representative Paul Hovley introduced SB 619. The bill was filed at the request of Attorney General Ellen Rosenblum. The Attorney General’s office convened a work group over the summer and fall to work on the bill. The bill was referred to the Joint Committee on Ways and Means.
Tennessee
Republic Senator Bo Watson introduced SB73 on January 4, 2023. The bill passed first and second consideration and is held at the desk pending committee appointments. The bill text is available here. Tennessee lawmakers considered a similar bill last year.
4. Biometric Privacy Bills
The following states are considering BIPA-like biometric information privacy bills:
Hawaii
The Hawaii Biometric Information Privacy Act (SB 1085) was introduced on January 20, 2023.
Maryland
Delegates Love, Charkoudian, Lehman, and Watson introduced HB 33 on January 11, 2023. The bill was referred to the Economic Matters Committee. Last year, the Maryland House passed HB 259, but the bill did not make it out of the Senate. On January 20, 2023, a group of thirteen senators cross-filed SB0335 in the Senate. The bill was referred to the Finance Committee.
Mississippi
Representative Anthony Porter introduced HB 467 on January 12, 2023. The bill was referred to the Judiciary Committee.
New York
On January 17, 2023, a group of New York lawmakers introduced the New York Biometric Privacy Act (A1362). The bill was referred to the Consumer Affairs and Protection Committee.
On January 20, 2023, Senator John Liu introduced S2390, which would prohibit private entities from using biometric data for any advertising, marketing or any other identified activities. The bill was referred to the Consumer Protection Committee.
5. Data Broker Bills
The following states are considering bills that would regulate data brokers:
New Jersey
Democrat Assemblyman William Moen, Jr. introduced A4811 on October 20, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee.
Oregon
HB 2052 was introduced at the request of the Attorney General’s office. The Business and Labor Committee held a public hearing on January 18, 2023. Last year lawmakers considered HB 4017.
6. Children’s Privacy Bills
The following states are considering legislation to regulate children’s privacy. This list of bills is not intended to cover student data privacy bills.
New Jersey
Democrat Assemblyman Conaway, Jr. introduced A4919 on December 5, 2022. The bill was referred to the Assembly Science, Innovation and Technology Committee. A companion bill (S3493) was introduced by Democrat Senator Vitale on January 19, 2023, and referred to the Law and Public Safety Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Oregon
Democrat Senator Chris Gorsek introduced SB196. The bill was referred to the Judiciary Committee. The bill appears to be based on the California Age-Appropriate Design Code law that passed in 2022.
Texas
Texas lawmakers are considering HB 896, which would prohibit an individual between 13 and 18 years of age from using a social media platform.
Virginia
Lawmakers introduced companion bills to amend the Virginia Consumer Data Protection Act (VCDPA) (HB 1688 / SB 1026). The bills would amend the VCDPA by (1) re-defining “child” to be a person under 18 years of age (and not under 13); (2) require operators to obtain parental consent prior to registering a child for their product or services; and (3) require operators to not knowingly process the personal data of a child for purposes of (i) targeted advertising, (ii) the sale of such personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.
The House bill was referred to the Committee on Communications, Technology and Innovation. The Senate bill was referred to the Committee on General Laws and Technology.
West Virginia
Delegate Wayne Clark introduced HB 2460 on January 11, 2023. The bill states that it is intended to “complement the body of federal law governing online privacy protections for children” and would extend protections to children under 18. The bill was referred to the House Judiciary Committee.
7. Health Data Privacy Bills
The following states are considering bills that would create new or additional privacy protections for health data processed by private entities:
Massachusetts
Massachusetts lawmakers filed two health data privacy companion bills – SD 2118 and HD 3855.
New York
Senator Liz Krueger filed SB 158 on January 4, 2023. The bill was referred to the Senate Internet and Technology Committee.
Virginia
Lawmakers are considering companion bills HB 2219 and SB 1432. The House bill was referred to the Committee on Health, Welfare and Institutions. The Senate bill was referred to the Committee on Education and Health.
Washington
Companion bills were filed in the House (HB 1155) and Senate (SB 5351). The House bill was referred to the Civil Rights & Judiciary Committee. The Senate bill was referred to the Law & Justice Committee.
8. Automated Employment Decision Tools Bills
The following states are considering bills that would regulate the use of automated employment decision tools. These bills are similar to New York City Local Law 144.
New Jersey
A group of assembly members introduced A4909 on December 5, 2022. The bill was referred to the Assembly Labor Committee. On January 19, 2023, the bill was reported and referred to the Assembly Science, Innovation and Technology Committee. An identical bill was introduced in the Senate by Senator Andrew Zwicker under bill number S1926. That bill was referred to the Senate Labor Committee.
New York
Representative Latoya Joyner introduced A567 on January 9, 2023. The bill was referred to the Labor Committee.
9. Algorithmic Discrimination Bills
These bills would protect against algorithmic discrimination and promote transparency such as the Washington, D.C. Stop Discrimination by Algorithms Act of 2021 (B24-0558). Our focus is on bills that impact businesses, not government. No states have proposed such legislation to date.
[View source.]
