Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—Feb. 13-17, 2023, (Feb 22, 2023)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what’s on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

First, a quick note: We’ll be off next week while the editorial coordinator for The Week is on assignment. The next update will appear on March 6.

Last week, Kansas and Kentucky advanced measures that would ban TikTok from state-issued devices and networks, and comprehensive privacy legislation was introduced in Maryland, among other items.

RECENT DEVELOPMENTS

TikTok bans advance in Kansas, Kentucky. Bills that would ban the downloading of TikTok on government-issued devices and networks moved forward in Kansas and Kentucky last week. The Kansas state House voted on Feb. 16 to approve HB 2314, while the Kentucky state Senate approved SB 20 on Feb. 10 (CPR, Feb. 13). The Kansas bill moves to the Senate, where it will be considered in the Federal and State Affairs Committee, and the Kansas bill is awaiting assignment from the House Committee on Committees.

Maryland bill would establish privacy, biometric standards. The Maryland Online and Biometric Privacy Act (HB 807) was introduced in the state House on Feb. 8. The bill would establish data controller responsibilities, require controllers to conduct data protection assessments when processing activities present a heightened risk to consumers, and provide for enforcement authority and a private right of action, and would require controllers and processors of biometric data to meet specified notice, consent, and data retention provisions (CPR, Feb. 13). The bill, a companion to SB 698, has been referred to the House Economic Matters Committee.

West Virginia comprehensive privacy bill introduced. The West Virginia state House is considering the Consumer Data Protection Act, HB 3453. The bill, introduced on Feb. 14, would establish a privacy regime in the state similar to other recently enacted comprehensive privacy laws, including conferring data rights on consumers, imposing obligations on controllers, and establishing enforcement parameters as well as a private right of action (CPR, Feb. 15). The bill has been referred to the House Technology and Infrastructure Committee.

CCPA files final rulemaking package. The California Privacy Protection Agency (CPPA) announced on Feb. 14 that it had filed its substantive rulemaking package regarding proposed regulations implementing the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), with the state's Office of Administrative Law (OAL) for its review (CPR, Feb. 15). The OAL has 30 days to approve the rules as submitted, and they will take effect shortly thereafter.

Virginia bill prohibiting contracting with scrutinized companies dies. On Feb. 15, the Virginia state Senate Finance and Appropriations Committee failed to report HB 2385, a bill that would have prohibited state agencies from entering into a contract for goods or services with a scrutinized company (i.e., any company owned or operated by a foreign adversary, unless the Committee on Foreign Investment in the United States has determined that there are no unresolved national security concerns regarding the transaction that created such ownership or permitted such operation). The state House had unanimously approved the bill on Feb. 3.

WHAT’S COMING UP

In Hawaii, SB 974, one of the comprehensive privacy bills currently under consideration in the state (CPR, Feb. 6) will have a hearing in the Senate Ways and Means Committee on Feb. 22.

An Arkansas bill (SB 4) seeking to ban TikTok from state-issued devices and networks will be discussed in the Senate State Agencies and Government Affairs Committee on Feb. 21.

A bill in Vermont (SB 49) that would enact the Genetic Information Privacy Act in the state, will be considered in the Senate Economic Development, Housing and General Affairs Committee on Feb. 24. Also In Vermont, the House Commerce and Economic Development Committee will consider HB 121, which would establish a comprehensive privacy law in the state, on Feb. 22 and 23.

The Illinois state House Cybersecurity, Data Analytics and IT Committee will meet on Feb. 23 to discuss HB 2130, a bill that would adopt the model Insurance Data Security Law from the National Association of Insurance Commissioners.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 58

Enacted Bills: 0

Failed Bills: 2

2023 Total:

Introduced Bills: 460

Enacted Bills: 0

Failed Bills: 9

MainStory: CCPA DataBreach DataPrivacy DataSecurity StateLegislation LitigationEnforcement