iPrivacy at the state level can get messy and confusing—particularly in the current moment with the record number of proposed bills under consideration. So let’s face it: it is great to read about all those proposed bills but what US privacy professionals really want to know is which bills will pass and which bills will fail.
So, without further delay, here are the 2021 SPB’s State Comprehensive Privacy Bill predictions.
Our 2021 Final Four: Connecticut, Florida, Oklahoma and Washington
No.1: Connecticut’s Act Concerning Consumer Privacy (SB 893)
Arguably it is too early to predict the outcome of SB 893. After all, the bill is still stuck in Committee, and there were several comments filed in opposition during the February 25 public hearing. Why are we bullish on Connecticut then? The bill has the support of the Connecticut ACLU (although it is worth noting that the private right of action was removed after the ACLU expressed its support). More importantly, the Connecticut’s Attorney General Office and the Connecticut’s Senate Majority Leader strongly support the bill and Connecticut (like Virginia) is a democratic trifecta where the DNC has full control of the governorship, the state senate, and the state house. As currently drafted, Connecticut’s Act Concerning Consumer Privacy is very similar to the Virginia VCDPA (see our posting on the requirements under the VCDPA here.) The Connecticut legislature has time to reach consensus (it does not adjourn until June 9th) and we plan on keeping a close eye on developments in the state.
No 2: Florida’s Consumer Privacy Acts (SB 1734 and HB 969)
It has been reported that an unknown activist is behind the progress of these two Florida bills. Not surprising-this is consistent with a trend seen these past couple of years of other privacy activists similarly reshaping states’ legislative agendas. These bills are inching closer and closer to California’s CPRA in an indisputably red state, which is a remarkable development in and of itself. Florida is also the third most populous state in the nation, which means any privacy legislation enacted in the state will likely have significant sway in any future talks about federal privacy legislation. Although the Florida legislature is adjourning on April 30th, the fact that very closely aligned bills are progressing in tandem through the Senate and the House fairs well for a potential opportunity to compromise leading to enactment. We will find out soon the outcome in Florida but, in the meanwhile, here is our most recent posting on the Florida developments.
No. 3: The Oklahoma Computer Data Privacy Act (HB 1602)
Nobody seems to be paying attention to this bill but it is well-positioned to become the 2021 Cinderella Story. HB 1602 significantly differs from already enacted comprehensive privacy bills with the current version including no private right of action but featuring an opt-in consent requirement across the board before collecting, using or selling any personal information. The bill sailed through the Oklahoma house with overwhelming bi-partisan support (Ayes: 85 Nays: 11.) Oklahoma was our number one until we heard last week the chair of the Oklahoma Senate Judiciary Committee (through which the bill must pass before being brought to the floor of the Senate) may not be willing to take it up. That said, there is enough time left in the legislative calendar to build consensus and get it to the finish line (the Oklahoma legislature will not adjourn until May 28th). Oklahoma is currently a Republican trifecta, which should help avoid a governor veto. If enacted, it will be the first comprehensive privacy bill to become the law of the land in a republican controlled state and could become a viable model for other republican controlled state legislatures. For more details read our post here.
No 4: Washington Privacy Bills (HB 1433 and (SB 5062)
Washington certainly deserves “an A for effort.” The state legislature has been trying to enact the Washington Privacy Act (SB 5062) for 2 years and counting. Last year it actually enacted regulations affecting the public sector handling of personal information but consensus on enforcement effectively brought legislative progress for the private sector to a halt. In 2021 the ACLU decided to back a new bill (the People’s Privacy Act – HB 1433) and has published a chart comparing its bill to the WPA here. Why are we still optimistic on Washington? In a surprise move, on March 26 SB 5062 was amended to add a private right of action allowing state residents to sue over alleged violations. Significantly, however, the private right of action does not include a provision for monetary damages—leaving residents with the exclusive option of seeking injunctive relief (or alternatively filing a complaint with the consumer protection division of the attorney general’s office). Will this suffice to swing enough votes to get WPA through the finish line? On April 1st it passed the Civil Rights & Judiciary Committee and is now heading for the floor of the house. We will find the ultimate outcome soon (the Washington legislature is set to adjourn April 25th). Just like last year this promises to be a real nail-biter.
How about the rest of the States?
If your favorite state privacy bill did not make it to our final four, not to worry. There are many close calls that we had to make to come up with our final four bracket and we predict many last minute twists and turns. And never forget the still possible comprehensive federal privacy law. With those developments, we will continue to keep you informed of what you need to know in this rapidly developing area. Stay tuned!
