Since our last update, comprehensive privacy law proposals have continued to emerge and progress through state legislatures. Most notably, five bills have now passed a legislative chamber, with Hawaii’s Consumer Data Protection Act (SB 974), Iowa’s SF 262, and Montana’s Consumer Data Privacy Act (SB 384) joining the previously covered Indiana Senate Bill 5 and New Jersey S. 332.
Meanwhile, new bills continue to be proposed. Five new states (Rhode Island, Illinois, Montana, West Virginia, and Florida) have seen the introduction of comprehensive bills, bringing the total to 21 states thus far this legislative session. And a bill in one of those states — Montana’s SB 384 — has already passed the state senate.
These developments take place as Congress moves to revisit a federal data privacy bill. On March 1, the House Committee on Energy and Commerce’s Subcommittee on Innovation, Data, and Commerce held a hearing titled “Promoting U.S. Innovation and Individual Liberty through a National Standard for Data Privacy.” A key takeaway of this hearing is that Congress appears poised to resume efforts to pass some version of the American Data Privacy and Protection Act (ADPPA), a federal privacy proposal that was approved by the committee at the end of last year, but ultimately failed to progress any further in the legislative process. Notably, the ADPPA would have preempted many state comprehensive privacy laws — thus, should Congress pass similar legislation this year, it may have the effect of overriding any state comprehensive privacy laws on the books.
To keep updated on comprehensive privacy law developments at both the federal and state levels, be sure to subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.
