Keypoint: This week lawmakers introduced new bills in Georgia, Hawaii and Oklahoma, the Indiana Senate passed a bill out of committee, and hearings were held on bills in Alaska, Maryland, and Washington.

Below is our third weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide two reminders.

First, we will be regularly updating our 2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.

Second, the contents provided below are time-sensitive and subject to change. If you are not already subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Table of Contents

  1. What's New?
  2. Upcoming Hearings
  3. CCPA-Like Privacy Bills
  4. VCDPA Amendments
  5. Biometric Privacy Bills
  6. Data Broker Bills
  7. Other Bills

1. What's New?

We continue to see new CCPA-like privacy bills with lawmakers in three states introducing bills last week:

  • Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.
  • Hawaii lawmakers introduced three bills: HB 2051, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means.
  • Oklahoma Representative O'Donnell introduced HB 3477. The bill is based on the Uniform Law Commission's model act.

In total, there are now twenty states, plus the District of Columbia, considering CCPA-like consumer privacy legislation. We expect lawmakers in at least three other states to propose bills in the coming weeks.

Lawmakers also conducted hearings on four bills last week:

  • On January 25, 2022, the Washington House Committee on Civil Rights & Judiciary held a hearing on HB 1850 - the Washington Foundational Data Privacy Act. The committee also considered the bill during executive session on January 28, 2022. The bill is set for another executive session on February 2, 2022.
  • On January 26, 2022, the Maryland Senate Finance Committee held a hearing on SB 11.
  • On January 26 and 28, 2022, the Alaska House Labor & Finance Committee held hearings on HB 159. The committee is set for another hearing on January 31, 2022.
  • On January 27, 2022, the Indiana Senate Committee on Commerce and Technology held a hearing on SB 358 and voted 10-0 to vote the bill out of committee. Prior to doing so, the as-introduced bill was amended and replaced with a new bill based on the VCDPA.

In related news, Washington Senator Reuven Carlyle - author of the Washington Privacy Act - announced that he will not seek re-election to the senate in 2022.

In Virginia, there was a little bit of movement on the Virginia Consumer Data Protection Act amendment bills. On January 27, a House subcommittee of the General Laws Committee voted 8-0 to recommend reporting HB 381. That bill seeks to modify the right to delete.

In addition to CCPA-like privacy bills, the list of states considering biometric privacy bills continues to grow with lawmakers in Maine introducing LD 1945. There are now six states considering such bills.

We also saw developments with data broker bills. On January 25, 2022, the Delaware House Technology & Telecommunications Committee held a public hearing on HB 262. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee. Also, lawmakers in Oregon introduced HB 4017. There are now four states considering such bills.

2. Upcoming Hearings

January 31

  • Public hearing on Alaska HB 159 in House Labor & Commerce Committee

February 2

  • Public hearing on Maryland HB 259 (biometric information privacy bill) in House Economic Matters Committee
  • Executive session on Washington HB 1850 in House Committee on Civil Rights & Judiciary
  • Public hearing on Alaska HB 159 in House Judiciary Committee (pending referral)

February 9

  • Public hearing on Maryland SB 335 (biometric information privacy bill) in Senate Finance Committee

February 28

  • Public hearing on Nebraska LB 1188 in Banking, Commerce and Insurance Committee

3. CCPA-Like Privacy Bills

Below is an analysis of the status of proposed bills. For links to these bills, please see our 2022 State Privacy Law Tracker.

Alaska

Alaska lawmakers are considering three bills - HB 222, HB 159 and SB 116. On January 26 and 28, 2022, the Alaska House Labor & Finance Committee held hearings on HB 159. The committee is set for another hearing on January 31, 2022.

Arizona

Representative Domingo DeGrazia - author of HB 2865 in 2021 - reported that he will be filing at least one privacy bill in 2022.

Connecticut

Over the summer, Connecticut Senator James Maroney, who introduced SB 893 in 2021, convened a privacy working group comprised of various stakeholders to prepare the bill for the 2022 legislative. It is expected that an updated bill will be introduced when Connecticut's legislature opens in February.

District of Columbia

Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.

Florida

Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed HB 9 on January 11, 2022. That bill was referred to the House Commerce Committee.

Georgia

Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.

Hawaii

Hawaii lawmakers have introduced three bills: HB 2051, SB 2428, and SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means.

Indiana

Representative Hamilton introduced HB 1261 on January 10, 2022. The bill was referred to the House Committee on Commerce, Small Business and Economic Development.

Senator Brown introduced SB 358 on January 12, 2022. The Senate Committee on Commerce and Technology voted the bill out of committee on January 27, 2022.

Kentucky

Senator Westerfield introduced SB 15 on January 13, 2022. The bill was referred to the Committee on Committees.

Maryland

Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act (SB 11) in October. On January 26, 2022, the Senate Finance Committee held a hearing on SB 11.

Massachusetts

Massachusetts lawmakers continue to consider the Massachusetts Information Privacy Act (H.136, H.142 & S.46). Those bills were referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. The Committee held a hearing on October 13, 2021, but has not scheduled any additional hearings to date.

Minnesota

Last year, the Minnesota legislature considered HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill when the Minnesota legislature opens in late January.

Mississippi

Senator Angela Turner-Ford reintroduced the Mississippi Consumer Data Privacy Act (SB 2330) on January 17, 2022. The bill was referred to the Senate Judiciary, Division A committee.

Nebraska

Senator Michael Flood introduced LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission's model act. The bill is scheduled for a hearing on February 28, 2022.

New Jersey

New Jersey lawmakers filed three bills: S332, A505, and A1971.

New York

As shown on our tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. That bill passed out of the Senate Consumer Protection Committee in 2021 but did not advance further. The bill has been referred back to the Consumer Protection Committee.

North Carolina

In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.

Ohio

The Ohio Personal Privacy Act (HB 376) was introduced on July 13, 2021 and referred to the House Government Oversight Committee. From September to December, the Committee held four hearings on the bill but has yet to vote on it. In December, it was reported that the bill had been held back from a Committee vote to allow for further consideration. The bill carried over into 2022.

Oklahoma

Oklahoma lawmakers will consider two bills filed by Representative Collin Walke when the legislature opens in February. HB 1602, which passed the Oklahoma House last year but stalled in the Senate, will carry over. Representative Walke pre-filed a second bill - HB 2969 - in September. Finally, Oklahoma Representative O'Donnell introduced HB 3477. The bill is based on the Uniform Law Commission's model act.

Pennsylvania

Pennsylvania lawmakers are considering three bills.

HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.

In December 2021, lawmakers introduced a second bill - HB2202. That bill also was referred to the House Consumer Affairs Committee.

Finally, on January 20, 2022, lawmakers introduced a third bill - HB 2257 - which also was referred to the House Consumer Affairs Committee.

The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.

South Carolina

Lawmakers introduced the South Carolina Biometric Data Privacy Act (H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.

Tennessee

Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced HB 1197.

Vermont

Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.

On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.

Washington

Washington lawmakers are considering a number of privacy bills in 2022.

Senator Carlyle's Washington Privacy Act (SB 5062) carried over from last year. In 2021, that bill passed the Senate but failed in the House. The bill is assigned to the Senate Rules Committee.

Senator Carlyle also introduced SB 5813, which addresses children and adolescent information, data brokers, and opt out signals. On January 20, 2022, the Washington Senate Committee on Environment, Energy & Technology held a hearing on the bill.

Representative Kloba's People's Privacy Act (HB 1433) also carried over from 2021. Representative Kloba is working on an amended bill.

Finally, Representatives Vandana Slatter and April Berg introduced the Washington Foundational Data Privacy Act (HB 1850). The bill is similar to the Colorado and Virginia laws, but it contains an annual registration requirement, would create the Washington State Consumer Data Privacy Commission (similar to the California Privacy Protection Agency), and contains a private right of action. On January 25, the Washington House Committee on Civil Rights & Judiciary held a hearing on HB 1850. The committee also considered the bill during executive session on January 28, 2022. The bill is set for another executive session on February 2, 2022.

4. VCDPA Amendments

Virginia lawmakers are considering eight bills that would amend the VCDPA:

House Bill 381, Senate Bill 393, and Senate Bill 584 would add a new exemption to the VCDPA's right to delete. On January 27, 2022, a subcommittee of the House General Laws Committee voted 8-0 to recommend reporting HB 381.

House Bill 552 and Senate Bill 516 would expand the VCDPA's definition of "nonprofit organization" to include "any organization exempt from taxation under § 501 (c)(4) of the Internal Revenue Code that is identified in § 52-41."

House Bill 714 and Senate Bill 534 would modify the VCDPA's enforcement provisions and definition of "nonprofit organization."

HB 1259 would amend and restrict the definition of "sensitive data."

For more information, see our articles here and here.

5. Biometric Privacy Bills

Six states are considering BIPA-like biometric information privacy bills:

Kentucky

HB32 was introduced on January 4, 2022.

Maine

Lawmakers in Maine introduced a biometric information privacy bill (LD 1945). The bill was referred to the Judiciary Committee.

Maryland

Maryland lawmakers are considering HB 259 and SB 335, which are companion bills. The House bill is with the Economic Matters Committee and scheduled for a hearing on February 2, 2022. The Senate bill was assigned to the Senate Finance Committee and scheduled for a hearing on February 9, 2022.

Massachusetts

Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure.

New York

New York lawmakers are considering A 27. The bill was referred to the Assembly Consumer Affairs and Protection Committee.

West Virginia

HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.

6. Data Broker Bills

Four states are considering bills to regulate data brokers:

Delaware

Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.

Massachusetts

Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee.

Oregon

Lawmakers in Oregon are considering HB 4017.

Washington

As noted in Part 2, Senator Carlyle's SB 5813 seeks to regulate data brokers.

7.Other Bills

Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.

In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 (HB3009) and a computer algorithm regulation bill (HB 3011).

West Virginia lawmakers are considering HB 2148, which seeks to impose a general data mining service tax.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.