Keypoint: This week Indiana's bill continued to advance in the House (after previously passing the Senate), lawmakers voted bills out of committee in Iowa and Oklahoma, and new bills were introduced in Maine, Utah and Wisconsin.

Below is our sixth weekly update on the status of proposed state privacy legislation in 2022. Before we get to our update, we wanted to provide three reminders.

First, on February 23, 2022, we will be hosting a webinar to analyze the proposed CCPA-like privacy bills. For more information, and to register, click  here.

Second, we regularly update our  2022 State Privacy Law Tracker to keep pace with the latest developments with CCPA-like privacy bills. We encourage you to bookmark the page for easy reference.

Finally, the contents provided below are time-sensitive and subject to change. If you are not already  subscribed to our blog, consider doing so to stay updated. If you are interested in tracking developments between blog posts, consider following on LinkedIn and/or Twitter.

Table of Contents

  1. What's New?
  2. Upcoming Hearings
  3. CCPA-Like Privacy Bills
  4. VCDPA Amendments
  5. Biometric Privacy Bills
  6. Data Broker Bills
  7. Other Bills

1. What's New?

This week lawmakers voted three bills out of committee:

  • On February 15, 2022, the Iowa House Information Technology Committee voted 15-0 for favorable recommendation of  HSB 674.
  • On February 16, 2022, Representative Collin Walke's  HB 2969 passed the House Technology. Prior to passing, a committee amendment was filed, striking the prior version of the bill and replacing it with a version nearly identical to  HB 1602. According to Representative Walke, the difference between the two bills is that HB 2969 has a higher monetary threshold for applicability (annual gross revenues of $15 million instead of $10 million).
  • On February 17, 2022, the Indiana House Commerce, Small Business and Economic Development Committee passed SB 358.

Lawmakers also held hearings on bills in Wisconsin and Kentucky. Next week there are hearings scheduled on Wisconsin's AB 957 and Maine's  LD 1945 (biometric privacy bill). It is possible that more hearings will be held next week as many are being scheduled on short notice.

We also continue to see new bills introduced:

  • In Maine, Senator Rafferty introduced  LD 1982 on February 16, 2022. The bill was referred to the Innovation, Development, Economic Advancement and Business Committee.
  • In Utah, Senator Cullimore introduced SB 227 on February 18, 2022. The bill was referred to the Senate Revenue and Taxation Committee. The Utah legislature closes on March 4, 2022.
  • In Wisconsin, lawmakers introduced  AB 1050 on February 17, 2022. This is the fourth privacy bill introduced in Wisconsin this year. The bill appears to be a companion bill to SB 977.

In Washington, it appears that lawmakers may have again failed to pass privacy legislation. According to the legislative calendar, the last day to pass bills out of their house of origin was February 15, 2022. None of the four bills introduced or carried over this year ( SB 5062,  SB 5813,  HB 1433, and  HB 1850) met that deadline. In addition, on February 17, Senator Carlyle's Washington Privacy Act ( SB 5062) was placed on the Senate Rules "X" file. We will continue to monitor the bills through the March 10, 2022 adjournment date in case there are any developments.

In Virginia, there was more movement on VCDPA amendment bills with a number of the bills passing through chamber votes. More details in Section 4 below.

Finally, in biometric privacy bill news, HB 2716 was introduced in Missouri.

2. Upcoming Hearings

February 22

  • Executive session hearing on Wisconsin AB 957
  • Public  hearing on Maine LD 1945 (biometric privacy bill) in Judiciary Committee

February 28

  • Public hearing on Nebraska LB 1188 in Banking, Commerce and Insurance Committee

3. CCPA-Like Privacy Bills

Below is an analysis of the status of proposed bills. For links to these bills, please see our  2022 State Privacy Law Tracker.

Alaska

Alaska lawmakers are considering three bills - HB 222, HB 159 and SB 116. On February 4, the Alaska House Labor & Commerce Committee voted  HB 159 out of committee. The House Judiciary Committee held a hearing on February 7, 2022. No vote was taken.

Arizona

Representative DeGrazia filed HB2790.

Connecticut

Connecticut Senator James Maroney, who introduced  SB 893 in 2021, has scheduled a hearing on a revised bill for February 22, 2022. The revised bill has not yet been published.

District of Columbia

Council Chairman Mendelson introduced B24-0451 at the request of the Uniform Law Commission (ULC). The bill is based on the Uniform Personal Data Protection Act drafted by the ULC. The bill was referred to the Committee on Judiciary and Public Safety.

Florida

Florida lawmakers proposed two bills to date. Senator Bradley filed SB 1864 on January 7, 2022. That bill was referred to the Senate committees on Commerce and Tourism, Regulated Industries and Rules. In the House, Representative McFarland filed  HB 9 on January 11, 2022.  On February 10, 2022, the Florida House Commerce Committee voted HB 9 out of committee. On February 14, 2022, the bill was referred to the Judiciary Committee. The Florida legislature closes on March 11, 2022.

Georgia

Georgia lawmakers introduced the Georgia Computer Data Privacy Act (SB 394) on January 26, 2022. The bill was assigned to the Senate Committee on Science and Technology.

Hawaii

Hawaii lawmakers introduced four bills:  HB 2051,  HB2341,  SB 2428, and  SB 2797. HB 2051 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Judiciary and Hawaiian Affairs. The House Committee on Higher Education & Technology held a hearing on February 2, 2022 and deferred the bill. SB 2428 and SB 2797 were referred to the Committees on Commerce and Consumer Protection, Judiciary, and Ways and Means. HB 2341 was referred to the House Committees on Higher Education and Technology, Consumer Protection & Commerce, and Finance.

Indiana

The Indiana Senate passed SB 358 on February 1, 2022. On February 17, 2022, the Indiana House Commerce, Small Business and Economic Development Committee passed the bill.

Iowa

Lawmakers introduced  HSB 674 and  SF2208. On February 15, 2022, the Iowa House Information Technology Committee voted 15-0 for favorable recommendation of  HSB 674. SF2208 was referred to a Commerce Committee subcommittee.

Kentucky

Senator Westerfield introduced SB 15 on January 13, 2022. On February 15, 2022, the Kentucky Senate Standing Committee on Economic Development, Tourism and Labor held an informational hearing on the bill.

Maryland

Senator Susan Lee pre-filed the Maryland Online Consumer Protection and Child Safety Act ( SB 11) in October. On January 26, 2022, the Senate Finance Committee held a hearing on the bill.

Massachusetts

The Joint Committee on Advanced Information Technology, the Internet and Cybersecurity passed an amended version of H.142 / S. 46 out of committee on February 1, 2022. The bill is now filed under S.2687 (the Massachusetts Information Privacy and Security Act). On February 14, 2022, the bill was referred to the Senate Ways and Means Committee.

Minnesota

Last year, the Minnesota legislature considered  HF 1492, sponsored by Representative Steve Elkins. Representative Elkins held an informational hearing on the bill over the summer and will be filing an amended bill.

Mississippi

SB 2330 died in committee.

Nebraska

Senator Michael Flood introduced  LB 1188 on January 20, 2022. The bill is based on the Uniform Law Commission's model act. The bill is scheduled for a hearing on February 28, 2022.

New Jersey

New Jersey lawmakers filed three bills: S332, A505, and A1971.

New York

As shown on our  tracker, New York lawmakers are considering a number of consumer privacy bills in 2022. Of note, the New York Privacy Act (S 6701A / A 680B) was amended and recommitted in early January. On February 8, 2022, the New York Senate Consumer Affairs Committee voted S6701A out of committee. The bill was reported and committed to the Internet and Technology Committee.

North Carolina

In 2021, Senator Joyce Waddell and others introduced SB569, the North Carolina Consumer Privacy Act. The bill was referred to the Committee on Rules and Operations of the Senate, where it has remained idle. The bill carried over into 2022.

Ohio

The Ohio Personal Privacy Act ( HB 376) was introduced on  July 13, 2021 and referred to the House Government Oversight Committee. On February 9, 2022, the Ohio House Government Oversight Committee voted  HB 376 out of committee. On February 16, 2022, the status of the bill was changed to "informally passed." According to the  IAPP's Joe Duball, this means that the bill is being held in place while it is worked on.

Oklahoma

Oklahoma lawmakers are considering three bills.  HB 1602, which passed the Oklahoma House last year but stalled in the Senate, carried over to 2022. Representative Walke also a second bill -  HB 2969. Finally, Oklahoma Representative O'Donnell introduced  HB 3477. The bill is based on the Uniform Law Commission's model act.

On February 16, 2022, Representative Collin Walke's HB 2969 passed the House Technology. Prior to passing, a committee amendment was filed, striking the prior version of the bill and replacing it with a version nearly identical to HB 1602. According to Representative Walke, the difference between the two bills is that HB 2969 has a higher monetary threshold for applicability (annual gross revenues of $15 million instead of $10 million).

Pennsylvania

Pennsylvania lawmakers are considering three bills.

HB 1126 was introduced in 2021 and referred to the House Consumer Affairs Committee where it remained idle. The bill will carry over to 2022.

In December 2021, lawmakers introduced a second bill -  HB2202. That bill also was referred to the House Consumer Affairs Committee.

Finally, on January 20, 2022, lawmakers introduced a third bill -  HB 2257 - which also was referred to the House Consumer Affairs Committee.

The Pennsylvania legislature is open year-round with recesses. It is set to reconvene on April 1, 2022.

Rhode Island

Lawmakers introduced H7400 on February 9, 2022. The bill was referred to the House Innovation, Internet and Technology Committee.

South Carolina

Lawmakers introduced the South Carolina Biometric Data Privacy Act ( H3063) in 2021. The bill was referred to the House Committee on Labor, Commerce, and Industry where it remained idle. The bill carried over to the 2022 session.

Tennessee

Asked to comment on the status of proposed privacy legislation, Tennessee lawmakers indicated that  HB1467 will carry over to 2022 and be the vehicle for such legislation. The text of the bill is not online. Last year, lawmakers introduced  HB 1197.

Utah

Senator Cullimore introduced SB 227 on February 18, 2022. The bill was referred to the Senate Revenue and Taxation Committee. The Utah legislature closes on March 4, 2022.

Vermont

Representative Maida Townsend sponsored H.160 in 2021. She confirmed that the bill carried over to the 2022 session.

On January 11, 2022, Representatives Marcotte and Kimbell introduced H.570, which was referred to the House Committee on Commerce and Economic Development.

Washington

It appears that Washington lawmakers may have once again failed to pass privacy legislation. According to the legislative calendar, the last day to pass bills out of their house of origin was February 15. (See also  here.) None of the four bills introduced or carried over this year ( SB 5062,  SB 5813,  HB 1433, and  HB 1850) met that deadline. In addition, on February 17, Senator Carlyle's Washington Privacy Act ( SB 5062) was placed on the Senate Rules "X" file.

West Virginia

West Virginia, lawmakers introduced  HB 4454. The bill was assigned to the House Judiciary Committee.

Wisconsin

Wisconsin lawmakers are considering four bills.

AB 957 and SB 957 are companion bills. On February 16, 2022, the Wisconsin House Committee on Consumer Protection held a hearing on AB 957. SB 957 was referred to the Committee on Government Operations, Legal Review and Consumer Protection.

Wisconsin lawmakers also introduced companion bills  SB 977 on February 9, 2022 and  AB 1050 on February 17, 2022. SB 977 was referred to the Committee on Government Operations, Legal Review and Consumer Protection. AB 1050 was referred to the Committee on Consumer Protection.

4. VCDPA Amendments

As the Virginia legislature's March 12 adjournment date inches closer, it appears we could see VCDPA amendments pass in the coming days. Here are some highlights:

  • The deadline for each house to work on its own bills passed on February 15. Five amendment bills met that deadline.
  • The remaining bills seek to (1) add a new exemption to the right to delete, (2) repeal the Consumer Privacy Fund, (3) modify the definition of nonprofit organization, and (4) change the VCDPA's treatment of sensitive data.
  • HB 1259, which seeks to amend the VCDPA's treatment of sensitive data, was amended this week and subsequently passed by the House.

We provide a full update on bills  here.

5. Biometric Privacy Bills

Seven states are considering BIPA-like biometric information privacy bills:

Kentucky

HB32 was introduced on January 4, 2022 and referred to the Committee on Committees.

Maine

Lawmakers in Maine introduced a biometric information privacy bill ( LD 1945). The bill was referred to the Judiciary Committee. A hearing has been scheduled for February 22, 2022.

Maryland

Maryland lawmakers are considering  HB 259 and  SB 335, which are companion bills. The House Economic Matters Committee held a  hearing on February 2, 2022. The Senate Finance Committee held a  hearing on February 9, 2022. No votes were taken.

Massachusetts

Massachusetts lawmakers are considering S.220. The bill was assigned to the Senate Committee on Consumer Protection and Professional Licensure. On February 14, 2022, the bill was incorporated into S.2687.

Missouri

HB 2716 was introduced on February 16, 2022.

New York

New York lawmakers are considering A27 and S1933. A27 was referred to the Assembly Consumer Affairs and Protection Committee. S1933 was referred to the Consumer Protection Committee.

West Virginia

HB2064 was introduced on January 12, 2022. The bill was assigned to the House Judiciary Committee.

6. Data Broker Bills

Four states are considering bills to regulate data brokers:

Delaware

Delaware lawmakers are considering HB 262. On January 25, 2022, the House Technology & Telecommunications Committee held a public hearing on the bill. The Committee reported the bill favorably out of committee and the bill was assigned to the appropriations committee.

Massachusetts

Massachusetts lawmakers are considering S.50. The bill was referred to the Advanced Information Technology, the Internet and Cybersecurity Committee. The bill was incorporated into S.2687.

Oregon

Lawmakers in Oregon are considering  HB 4017. The bill was passed out of the House Committee on Business and Labor on February 11 and referred to the Joint Ways and Means Committee.

Washington

As noted in Part 2, Senator Carlyle's  SB 5813 sought to regulate data brokers. That bill appears to have died.

7. Other Bills

Illinois Senator Thomas Cullerton introduced the Do Not Track Act (SB 3081) on January 11, 2022.

In Oklahoma, Representative Walke pre-filed the Voice Recognition Privacy Act of 2022 ( HB3009) and a computer algorithm regulation bill ( HB 3011). HB 3009 was referred to the House Technology Committee and a hearing scheduled for February 18. HB 3011 was referred to the Rules Committee.

West Virginia lawmakers are considering  HB 2148, which seeks to impose a general data mining service tax.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.