Key Point: This week, the Colorado Senate passed the Colorado Privacy Act, the Nevada legislature passed a bill to expand the state’s pre-existing right not to participate in sales, and the New York Privacy Act York advanced to a third reading in the Senate.
Below is our fourteenth weekly update on the status of CCPA-like privacy legislation. Before we got our update, we wanted to provide you with two reminders.
First, we’ve been periodically updating our follow-up to the 2021 state privacy law to keep up to date with the latest developments. We encourage you to add a page to your bookmarks for easy reference.
In Colorado, the Senate unanimously passed the Colorado Privacy Act. Our invoice analysis is available here. The bill now reaches the Colorado House, where it was assigned to the Treasury committee. No hearing date has been set with the committee. The Colorado legislature is adjourned June 12.
In Nevada, the legislature passed SB260 on May 25. The bill is now the governor’s. Assuming the governor signs the bill, it will amend the statutes of Nevada’s online privacy notice, NRS 603A.300-360, to offer Nevada residents a broader right to disable sales.
In New York, the Assembly version of the New York Privacy Act (A680) was amended and re-introduced to the Committee on Consumer Affairs and Protection. As we reported last week, on May 18, the Senate Consumer Protection Committee passed the New York Privacy Act (S6701) on May 18. The bill passed a third reading in the Senate on May 24th. The New York legislature is adjourned June 10.
Finally, the Alabama legislature closed without passing its bill.
To date, state lawmakers have introduced bills in 26 states. Several bills were introduced in Alaska, Connecticut, Florida, Illinois, Minnesota, New York, Massachusetts, and Washington. One state (Virginia) has passed legislation while bills from fourteen states (Alabama, Alaska, Arizona, Florida, Kentucky, Maryland, Mississippi, Minnesota, North Dakota, Oklahoma, South Carolina, Utah, Washington and Virginia) West) have failed.
The following analysis divides invoices into four categories: (1) approved invoices, (2) active invoices, (3) introduced invoices, and (4) dead invoices.
Approved bills are those that have become law (i.e., Virginia). Active bills are those that have experienced some movement, such as a commission or a vote. The bills introduced are those that have been introduced in a state legislature but have not yet seen any movement (other than, for example, being referred to a committee). Dead invoices are (as you might have guessed) invoices that have failed.
For links to all of these bills, see our 2021 state privacy law follow-up.
On March 2, 2021, Virginia became the second state – after California – to enact state legislation on consumer data privacy. You can find our Virginia bill coverage here and you can find the text of the new law here. We also organized a webinar on the law on March 11th. You can access the recording here.
The Colorado Senate unanimously passed the Colorado Privacy Act on May 26th. The bill now reaches the Colorado House where it was assigned to the finance committee. No hearing date has been set with the committee. The Colorado legislature is adjourned June 12.
SB 893, which is similar to Virginia’s Consumer Data Protection Act, was reported from the legislative commissioner’s office on April 8 and received a calendar number from the Senate. On April 28 it was referred to the Senate Judiciary Committee. On May 4 it was tabled in the Senate calendar. On May 12, it was referred to the Senate Appropriations Committee. On May 17, it was voted out of the Senate approval committee and presented on the Senate calendar. Senate Bill 156, a one-paragraph bill, introduced on Jan. 15, has not seen any movement since the joint general law committee held a public hearing on Feb. 25. The Connecticut legislature is adjourned June 9.
The Nevada legislature passed SB260 on May 25. The bill is now the governor’s. Assuming the governor signs the bill, it will amend the statutes of Nevada’s online privacy notice, NRS 603A.300-360, to offer Nevada residents a broader right to disable sales.
On March 15, the Assembly’s Science, Innovation and Technology Committee held a hearing on three bills (A5448, A3283 and A3255). A recording of the view is available here.
As shown on our tracker, New York lawmakers have proposed a series of consumer privacy bills in 2021. It should be noted that the New York Privacy Act was reintroduced on May 12 and passed from the Consumer Protection Committee. consumer of the Senate on May 18th. third reading on May 24th. The Assembly version of the New York Privacy Act (A680) was amended and re-introduced to the Consumer and Protection Committee on May 27th. The New York legislature rises on June 12th.
Presentation of invoices
Illinois is considering two bills.
First, HB 2404 (the Right to Know Act) is currently assigned to the rules committee. He had previously been assigned to the Cybersecurity, Data Analysis and Computer Science Committee. As its name suggests, the Right to Know Act would provide Illinois residents the right to know certain information about their personal information.
In addition to HB 2404, Illinois lawmakers also introduced HB 3910 (titled the Consumer Privacy Act) on February 22nd. This bill was assigned to the Judiciary – Civil Committee on March 16, to the Subcommittee on Civil Procedure and Civil Liability – referred to the Rules Committee on March 27. HB 3910 is a modified version of the CCPA.
SD 1726 was tabled on 18 February 2021. On 29 March it was referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity. The bill is an amended version of the Washington People’s Privacy Act. A second bill, HD 3847, was introduced in the state House. It was also referred to the Joint Committee on Advanced Information Technology, the Internet and Cybersecurity on 13 April.
Senate Bill 569 was introduced on April 6 and referred to the Senate Rules and Operations Committee. The North Carolina legislature is adjourned July 2.
House Bill 1126 was introduced on April 7 and referred to the Consumer Affairs Committee.
In Texas, Representative Capriglione introduced six bills “related to increasing the protection of consumer data by the private sector.” An invoice, HB 3741, is an omnibus data privacy invoice. As presented, the bill may best be described as a heavily modified version of the CCPA, but there are many aspects that make it unique, including the creation of three “categories” of data. On March 22, the bill was referred to the Chamber of Commerce and Industry Committee. The Texas legislature is adjourned May 31.
H.160 is still a short-form bill (i.e., it only has one long paragraph). The bill has been referred to the committee and so far no action has been taken. The Vermont legislature is adjourned May 28.
Alabama HB 216, Alaska SB 116 and HB 159, Arizona HB 2865, Florida HB 969 and SB 1734, Kentucky HB 408, Maryland SB 930, Minnesota HF 36 and HF 1492 / SF 1408, North Dakota HB 1330, Oklahoma HB 1602, Mississippi’s Senate Bill 2612, South Carolina H 3063, Utah SB 200, Washington SB 5062 and West Virginia HB 3159 are dead.