ARTICLE
28 February 2019

States Propose Bills With CCPA-Like Provisions

JD
Jones Day

Contributor

Jones Day is a global law firm with more than 2,500 lawyers across five continents. The Firm is distinguished by a singular tradition of client service; the mutual commitment to, and the seamless collaboration of, a true partnership; formidable legal talent across multiple disciplines and jurisdictions; and shared professional values that focus on client needs.
Six bills also permit individuals to request deletion of their information.
United States Privacy

The U.S. data privacy landscape continues to evolve. Last year, the California Consumer Privacy Act ("CCPA") passed following the EU General Data Protection Regulation ("GDPR"). Nine additional states have since introduced bills modeled at least in part on the CCPA and would require companies to provide notice of the types of personal information they collect and the third parties to whom they disclose it. The bills also grant individuals the right to access or opt-out of the sale of their personal information. Six bills also permit individuals to request deletion of their information. Several other bills propose a private right of action for certain violations. Washington proposes requirements that mirror the GDPR, such as defined roles for controllers and processors and the right to correct information.

Although some states (e.g., Rhode Island) limit application to entities that exceed certain gross revenues or other thresholds, all of the bills would apply broadly to companies regardless of industry, and a majority of them define "personal information" as any information that identifies an individual, including physical characteristics, employment history, medical information, IP addresses, internet activity, biometrics, and geolocation data. With one exception (Mississippi's bill died in committee on February 5), all of these bills have been referred to committees for further consideration.

Next Steps

Companies should continue to monitor the legislative progress of these bills, as well as attempts at the federal level to pass preemptive legislation.

Implementing an effective CCPA compliance program would go a long way toward satisfying potential compliance obligations on the horizon in other states.


 State/Bills

Introduced 

New Mexico (SB 176)  

1/2/19

 New York (S00224)

1/9/19

 Massachusetts (SD341)

1/12/19 

 North Dakota (HB 1485)

1/14/19

 Hawaii (SB 418)

1/18/19

 Mississippi (HB 1253)

1/25/19 

 Washington (SB 5376)

1/30/19

 Rhode Island (S0234)

1/31/19 

Maryland (SB0613)

2/4/19 

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More