Cybersecurity Policy Report, Privacy Bill Advances in Oklahoma Senate, (Feb 14, 2025)
The Oklahoma state Senate Technology and Telecommunications Committee voted this week pass a bill that would adopt comprehensive privacy and data protection requirements.
SB 546 would apply to companies that conduct business in Oklahoma or target products or services to state residents that have annual revenues of at least $25 million and either (a) control or process the personal data of 100,000 or more consumers or (b) derive over 50% of gross revenues from sales of personal data and control or process the data of 25,000 or more consumers.
The bill, which creates a variety of exceptions for specified entities and data types, would create consumer rights typical of most comprehensive state privacy laws, including the right to confirm whether a controller or processor is processing the consumer’s personal data, as well as rights of access, correction, deletion, and data portability. It also would allow opt-outs from processing for purposes of targeted advertising, sales of personal data, or profiling. It would impose requirements on controllers, including the provision of a privacy notice and the maintenance of contracts governing relationships with third-party processors.
The bill also would prohibit controllers from processing sensitive personal data without consent, as well as processing of children’s sensitive data unless done in accordance with the requirements of the federal Children's Online Privacy Protection Act.
SB 546 doesn’t contemplate a private right of action, granting exclusive enforcement authority to the state attorney general. It would allow for a 30-day cure period for violations and would authorize a fine of up to $7,500 for violations. The bill would take effect on July 1, 2026.
The bill (S.B. 546, Reg Sess.) is sponsored by Sen. Brent Howard (R.).
News: StateLegislation DataPrivacy