As we progress deeper into the 2024 legislative session, developments in the comprehensive privacy law arena have continued apace. In the weeks since our last update, New Hampshire formally joined the ranks of states with comprehensive data privacy laws on the books, with Governor Sununu signing SB 255 into law on March 6. Kentucky appears to be trailing closely behind, as it waits for the House to review two small Senate amendments before final passage of its own comprehensive bill. (You can read our analysis of that bill here). In addition to these developments, there has been significant progress in other states, as well, most notably with bills in Maryland and Pennsylvania passing a legislative chamber.
NEW PROPOSALS
We did not identify any new legislative proposals to report since our last update.
UPDATES ON EXISTING PROPOSALS
Kentucky’s HB 15 stands poised to be the next state comprehensive privacy law as the House reviews two minor amendments from the Senate before the bill is finalized. As we have written elsewhere, this bill is generally considered a copycat bill to Virginia’s comprehensive privacy law, and its lightweight enforcement regime and lack of a private right of action will come as a relief to businesses.
Meanwhile, Maryland’s SB 541/HB 567 and Pennsylvania’s HB 1201 were passed by their respective legislative chambers, potentially positioning those bills to achieve full legislative passage in the weeks ahead. And elsewhere, proposals in Minnesota (HF 2309/SF 2915) and Vermont (H. 121) received committee approvals.
Notably, West Virginia’s legislature closed on March 9, putting an end to the final sprint of HB 5698, which had appeared to be fast-tracking through the approval process with its passage in the House on February 28.
Active Bills That Have Cleared Legislative Chamber
- The Kentucky Senate passed HB 15 on March 11. The Kentucky House had previously passed the bill on February 20 and will now receive it back to the Rules Committee to review two minor amendments that the House will need to vote on again before final passage.
- The Georgia Consumer Privacy Protection Act (SB 473), which passed the Senate on February 27, was the subject of hearings before the House Technology and Infrastructure Innovation Committee on March 14 and March 20.
- Importantly, Georgia’s legislative session closes on March 28.
- Wisconsin AB 466, which was passed by the Assembly in November 2023, remains under consideration in the Senate, where it was approved by the Committee on Shared Revenue, Elections and Consumer Protection on February 15.
Recent Chamber Passages
- The Pennsylvania House passed HB 1201 on March 18.
- This bill largely hews to the model adopted in the non-California comprehensive privacy laws, most importantly by not including a private right of action. Notably, it would require companies to recognize opt-out preference signals by January 2026 and perform data protection assessments for data processing activities that “present a heightened risk of harm” to consumers. It also features applicability thresholds slightly broader than those seen in other states’ privacy laws. For example, in addition to the familiar threshold related to amount of personal information processed, the bill would apply to companies that do business in Pennsylvania and have annual gross revenues exceeding $10 million, as well as any company that derives at least 50% of its revenue from sales of personal information (regardless of the amount of personal information that the company processes).
- The Maryland Senate and House passed SB 541 and HB 567 on March 14 and March 16, respectively. The House Economic Matters Committee is now reviewing SB 541, while the Senate Finance Committee reviews HB 567 (with a hearing scheduled for March 21).
Committee Approvals
- The Vermont House Committee on Commerce and Economic Development approved H. 121 on March 15 and subsequently referred it to the House Committee on Judiciary, which held a hearing on the bill on March 20.
- Many in the privacy community are closely watching this bill as it contains a private right of action.
- The Minnesota House Judiciary Finance and Civil Law Committee approved the Minnesota Consumer Data Privacy Act (HF 2309) on March 7 and the State and Local Government Finance and Policy Committee approved the bill on March 14. The bill now sits with the House Ways and Means Committee.
- On the other side of the legislature, the Senate Commerce and Consumer Protection Committee passed SF 2915 (a companion to HF 2309) on March 7. The bill subsequently was referred to the Senate Judiciary and Public Safety Committee.
Committee Referrals
- The Illinois Data Privacy and Protection Act (HB 3385), first introduced in February 2023, was assigned to the House Cybersecurity, Data Analytics, and IT Committee for further consideration on March 12.
- Missouri SB 1501 was referred to the Senate Commerce, Consumer Protection, Energy and the Environment Committee on March 7.
Hearings, Meetings, and Work Sessions
- Maine continued to align and coordinate its efforts toward a comprehensive privacy law through joint work sessions for its Data Privacy and Protection Act (LD 1977) and Maine Consumer Privacy Act (LD 1973/SP807) on March 14.
Bill Deaths
