Delaware recently updated its personal data privacy law with House Bill 380. The amendments go into effect January 1, 2027. Key modifications to the existing Delaware privacy law include the following:
- Lower applicability thresholds. Beginning January 1, the law will apply to businesses that handle personal data for at least 10,000 consumers, a decrease from the current 35,000 threshold. Currently, the law also applies to those who process personal data of 10,000 state residents and earn more than 20% of gross revenue from selling personal data. That threshold will be lowered to 5,000 consumers. Beginning January 1, the law’s requirements will also apply to third parties who acquire personal data from a controller.
- Expanded definition of sensitive data. Sensitive information will be expanded to include both the data itself and inferences drawn from that data (alone or in combination with other data) if those inferences reveal traits about a person. As a reminder, in Delaware, sensitive information already includes data about racial, national, or ethnic origin, religious beliefs, mental or physical health conditions, pregnancy status, sexual orientation, or immigration status. As amended, sensitive data will also include neural data tied to central nervous system activity, financial account access data such as account numbers and login credentials, and non-public government ID numbers such as Social Security, passport, and driver’s license numbers.
- Consumer rights expanded. Adding to the current slate of consumer rights, beginning January 1, consumers can ask whether the business used automated tools to make decisions that significantly affect them. Consumers will also be able to request a list of the specific third parties that received personal data, not merely categories, unless the disclosed personal data is pseudonymous data, or if making the disclosure would be an undue burden to compile, in which case the controller must disclose all third parties to which it generally discloses personal data, or listing a third party would reveal trade secrets. There are some limits to this, including if information was anonymized, or if making the disclosure would be an undue burden or risk revealing trade secrets. Clarifying the disclosure right, as amended, the law makes clear that businesses cannot provide sensitive data elements like Social Security numbers. Instead, they should simply confirm that they process that element.
- New teen consent obligation. As amended, if the company has actual knowledge that a consumer is at least 13 and under 18, it must get consent before processing for targeted advertising. It will also need consent if selling teens’ personal data or profiling teens for major decisions.
- Automated decisionmaking rules. The amendment will also add obligations for decisions with significant legal effects. These include decisions about financial services, housing, insurance, education, employment, health care, or access to essential goods and services. Specifically, if a business shares a report with a third party for use in one of these decisions, it will need to have in place a contract with the third party that requires the third party to take certain steps. These include, among other things, telling residents of adverse actions that were based on the report and an explanation of the personal data used. The third party also needs to share with the individual any available human review process.
- Sales of sensitive data. As amended, the sale of sensitive data will be a high-risk activity and is prohibited unless the sale is strictly necessary to provide or maintain a product or service that the consumer affirmatively requested. Even when that necessity exists, the business will need to give prior clear and conspicuous notice that lists the specific categories of sensitive data involved, the purpose of the disclosure, and the third parties that will receive the sensitive data. The business will also need to get the consumer’s specific consent to the sale, and keep a record of that consent for five years. The record of consent will need to be provided to the Attorney General along with any relevant data protection assessment if investigated by the AG.
- Contractual requirements. Beginning January 1, Delaware will join other states in requiring companies to have contracts with third-parties with whom information is shared, including for sales or targeted advertising. The content for those contracts mirror what is required in other states. This includes stating information is being sold or shared only for limited purposes, and if those include uses that will produce a legal or similarly significant impact. Contracts will also need to give the business rights to monitor compliance, require notice if the third party cannot comply, and allow steps to stop and fix unauthorized use.
- De-identified and pseudonymous data oversight. As amended, if a company shares de-identified or pseudonymous data it will need to give reasonable oversight including by entering into contractual commitments to ensure the proper and limited use of that data. It will also need to have in place , contracts that limit use and steps to address contract breaches. Appropriate oversight should take into account the potential that re-identification might create sensitive data.
- Right to cure. Currently, Delaware’s Department of Justice enforces the law as an unlawful business practice. That will not change, but beginning January 1, 2027, the Department may allow an optional time to cure a violation.
Putting It Into Practice: Prior to the January 1, 2027 effective date, companies with global compliance programs will likely want to check their third-party contracts. At the same time, these changes are a good reason to review rights request processes, automated decision making, and sensitive data sales. Finally, this Delaware law is yet another example of lawmakers making tweaks to provisions that apply to teens.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
