Federal Privacy Bill Hits Roadblock, State Activity Picks Up Speed

At the eleventh hour, the House Energy and Commerce Committee cancelled a markup scheduled for Thursday that included the American Privacy Rights Act of 2024 (APRA). At the state level, by contrast, Minnesota and Rhode Island recently enacted their own comprehensive data privacy laws, bringing the total to 20. And previously adopted statutes in three states – Oregon, Texas, and Florida – go into effect on July 1.

Having cleared the Innovation, Data, and Commerce Subcommittee late last month, the APRA was one of eleven bills on the agenda for yesterday's full committee markup. Chair Cathy McMorris Rodgers (R-WA) did not state a reason for the last-minute cancellation, but The Hill reported that House Republican leadership objected to the private right of action created by the discussion draft.

As it happens, in "Congressional Leaders Return Privacy to the Front Burner," an April Perspectives from FSF Scholars, I anticipated that "the APRA's problematic inclusion of a private right of action may – and should – prove once again to be a sticking point."

The already sizeable patchwork of state comprehensive data privacy laws, meanwhile, continues to grow. (So, too, do the associated compliance headaches for companies and confusion faced by consumers.) On May 24, 2024, North Star State Governor Tim Walz signed the Minnesota Consumer Data Privacy Act, a law similar – though not identical, of course – to those passed in New Hampshire and Maryland.

And on June 25, 2024, Ocean State Governor Dan McKee transmitted with no signature the Rhode Island Data Transparency and Privacy Protection Act, bringing the total of state comprehensive data privacy laws to 20. The Rhode Island statute is notable for its relatively large fines: up to $10,000 per violation, plus additional penalties for "intentional disclosures of personal data."

The Minnesota act will not go into effect until July 31, 2025, the Rhode Island law not until January 1, 2026. Laws in three other states, however, kick in on the first day of July: the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, and – by my measure, at least – the Florida Digital Bill of Rights.

For additional details on these statutes, please see "More States Compound the Dreaded Privacy 'Patchwork' Problem," a July 2023 Free State Foundation Perspectives.

Florida Vies for Bronze in Race to Create Patchwork of State Data Privacy Laws

Florida seems likely to become the third state, after California and Virginia, to adopt a comprehensive data policy law.

The California Consumer Privacy Act (CCPA) has been in effect since the beginning of 2020. Given the inability of Congress thus far to reach consensus on federal legislation, the CCPA has served as the de facto U.S. data privacy law for over a year. Last November, voters approved the California Privacy Rights Act (CPRA), which will expand upon the CCPA in numerous ways at the beginning of 2023.

On March 2, Virginia Governor Ralph Northam added the second square to the quilt when he signed into law the Consumer Data Privacy Act, the details of which I described in a February 5 post to the FSF Blog. Like the CPRA, it becomes effective on January 1, 2023.

A number of additional states, including Minnesota, New York, Oklahoma, and Washington State, are considering comprehensive data privacy legislation. Florida, however, appears poised to be the next to act.

On February 15, Florida House of Representatives member Fiona McFarland introduced House Bill (H.B.) 969. The draft legislation, which has the support of Governor Ron DeSantis and House Speaker Chris Sprowls, on Wednesday received unanimous committee approval upon its first reading.

H.B. 969 would establish a number of consumer data privacy rights: the right to know what personal information businesses collect; rights to receive a copy of, correct, and delete that data; and the right to opt-out of its sale to third parties. It also would prohibit discrimination against a consumer who exercises any of these rights.

In addition, H.B. 969 would impose a requirement to delete collected data "after satisfaction of the initial purpose for collecting or obtaining such information, or after the duration of a contract, or 1 year after the consumer's last interaction with the business, whichever comes first."

The Department of Legal Affairs would be responsible for enforcing the provisions of H.B. 969. However, businesses first would be afforded a 30-day opportunity to cure.

Of perhaps greatest concern, H.B. 969 also would establish a private right of action in connection with a data breach. Affected consumers could pursue both (1) up to $750 in statutory damages or actual damages, whichever is greater, and (2) injunctive or declaratory relief.

If passed, H.B. 969 would go into effect at the beginning of next year.

Be on the lookout for additional commentary from the Free State Foundation on state data privacy laws in the coming days.