Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—Apr. 1-5, 2024, (Apr 8, 2024)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, Kentucky became the 15th state to enact a comprehensive privacy law, and Maryland moved closer to approving similar legislation, among other developments.

RECENT DEVELOPMENTS

Kentucky governor signs privacy bill into law. Kentucky Gov. Andy Beshear signed the state’s version of a comprehensive privacy and data protection law on April 4. HB 15, effective Jan. 1, 2026, gives consumers the right to request information about personal data being collected, as well as correction and deletion rights, and allows allow consumers to opt out of tracking, targeted advertising, and the sale or sharing of their personal data, among other provisions (CPR, April 5). The law, similar in structure to Virginia’s Consumer Data Privacy Act, also provides for exclusive enforcement by the attorney general, with a non-expiring 30-day cure period for violations.

Maryland House approves comprehensive privacy bill. On April 4, the Maryland state House approved SB 541, one of the state’s versions of comprehensive privacy and data protection legislation currently under consideration. If approved, the bill would enact the Maryland Online Data Privacy Act, regulating the manner in which a controller or a processor may process a consumer’s personal data, authorizing a consumer to exercise certain rights regarding their personal data, and requiring a controller of personal data to establish a method for a consumer to exercise certain rights related to personal data (CPR, April 5). The House version of the legislation, HB 567, passed its second reading in the Senate on April 4, but it is not yet clear which version of the bill will be sent to Gov. Wes Moore (D.) for consideration.

Louisiana introduces data privacy bill. On April 2, HB 947, the Consumer Data Privacy Act, was introduced in the Louisiana state House. If enacted, the bill would confer rights on consumers and impose obligations on data controllers and processors similar to those in other states with comprehensive privacy laws (CPR, April 4). The bill would require businesses to respond quicky; if approved, it is scheduled to take effect on Dec. 31.

California privacy bills advance. Several privacy proposals under consideration in the California legislature were introduced or moved forward last week. AB 2905, a bill that would expand the definition of an automated dialing system subject to specified use limitations to include calls made using an artificial voice, was assigned to the Assembly Communications and Conveyance Committee, which will consider the proposal on April 10 (CPR, April 4).

On April 2, the Assembly Privacy and Consumer Protection Committee passed a bill (AB 3048) that would revise regulations adopted by the California Privacy Protection Agency (CPPA) related to opt-out preferences by requiring internet browsers to provide an opt-out preference signal that they can use to signal all of the businesses they interact with online that they are exercising their rights under the California Consumer Privacy Act (CCPA) (CPR, April 3).

Finally, also on April 2, the Privacy and Consumer Protection Committee approved AB 1949, the California Children’s Data Privacy Act, which proposes to strengthen protections of data privacy rights of children under the CCPA (CPR, April 3).

WHAT’S COMING UP

In Tennessee, the state House Civil Justice Committee will consider HB 2434, a bill that would specify that a private entity would not be held civilly liable in a class action resulting from a cybersecurity event unless the event was caused by willful, wanton, or gross negligence by the private entity. A companion bill in the Senate, SB 2018, was recommended for passage by the Senate Judiciary Committee on April 2.

A bill that would establish the Artificial Intelligence Accountability Act in California, is scheduled for a hearing in the state Senate Governmental Organization Committee on April 9. Among other requirements, AB 896 would require a variety of state offices to produce a risk-benefit analysis regarding generative AI that examines beneficial uses and potential threats and to update the report as prescribed.

The Ohio state House Primary and Secondary Education Committee will take up SB 29, a bill that would impose restrictions on the dissemination of education records for commercial purposes by technology providers and would require appropriate security safeguards with respect to such records, on April 9. The bill was approved by the Senate late November.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 2

Enacted Bills: 1

Failed Bills: 3

2024 Total (including carryforward)

Introduced Bills: 586

Enacted Bills: 20

Failed Bills: 17

MainStory: CCPA DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement AINews