Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—July 2024, (Jul 29, 2024)

Welcome again to The Week in State Privacy and Cybersecurity Legislation, your update on the latest developments in proposed and enacted privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of ...

As noted last month, we have scaled back to a monthly review of state privacy and data security legislation, thanks to the slowing of state legislative activity and the adjournment of sessions in most states. Keep in mind, however, that we continue to monitor activity on a daily basis and to update the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard, as new bills are introduced or move through the legislative process.

RECENT DEVELOPMENTS

Pennsylvania proposes comprehensive privacy bill. A bill was introduced in the Pennsylvania state Senate on July 12 that would, if enacted, establish the Pennsylvania Consumer Data Privacy Act. S.B. 1279, Reg. Sess., would confer data rights on consumers and impose obligations on businesses, including a prohibition on discrimination against customers who choose to exercise their rights (CPR, July 16). The bill has been assigned to the Senate Communications and Technology Committee.

California committees pass children’s privacy bills. On July 3, the California state Senate Judiciary Committee voted 11-0 to pass the California Children’s Data Privacy Act, which proposes to strengthen protections of data privacy rights of children under the California Consumer Privacy Act (CCPA). The bill (A.B. 1949, Reg. Sess.) concludes that the CCPA doesn’t effectively protect consumers under age 18 or limit businesses from collecting or exploiting the data of young users so long as they do not sell it (CPR, July 8). The bill, which passed the Assembly on May 21, has been assigned to the Assembly Appropriations Committee for further consideration.

Meanwhile, on the same date, the state Assembly Privacy and Consumer Protection Committee passed S.B. 976, Reg. Sess., the Protect Our Kids from Social Media Addiction Act, which would prohibit social media platforms from sending an “addictive” social media feed to a minor without the consent of the youth’s parent or guardian (CPR, July 8). The bill, which passed the Senate on May 20, is now in the Assembly Appropriations Committee.

Pennsylvania law amends breach notification requirements. On June 28, Pennsylvania Gov. Josh Shapiro (D.) signed Act 33 (S.B. 824), Reg. Sess. (Pa. 2024), into law. Among other requirements, the act will require businesses and organizations to notify the state attorney general when a data breach impacts more than 500 individuals. It also requires certain information to be included in the notification and requires the provision of free credit monitoring services for up to one year after a breach occurs (CPR, July 8). The law takes effect on Sept. 26.

States active in implementing regulations, providing guidance for privacy laws. The final version of rules promulgated by the Florida Department of State designed to implement specific provisions of the Florida Digital Bill of Rights (FDBR) took effect July 18. The rules define who may act as an “authorized person” under the FDBR, outline general security practices for businesses, and specify enforcement provisions (CPR, July 18).

In Delaware, the Department of Justice’s Consumer Protection Unit launched a new personal data privacy portal on July 1 for use as a navigational tool for parents, consumers, and businesses that handle residents’ personal data to help them prepare to comply with the upcoming implementation of the Delaware Personal Data Privacy Act (DPDPA). The portal provides key information for businesses to help them with compliance and will continue to be updated with new materials and information (CPR, July 9).

Meanwhile, the California Privacy Protection Agency (CPPA) held a board meeting on July 16 at which it discussed pending regulations on automated decision making technology, risk assessments, cybersecurity audits, insurance, and updates to existing regulations (CPR, July 8). Earlier in the month, the agency requested public comments on its proposed rules to implement data broker registration requirements under the recently enacted Delete Act (CPR, July 8).

WHAT’S COMING UP

The California state Senate Appropriations Committee meets Aug. 5 to consider a bill that would revise certain regulations adopted by the CPPA related to opt-out preferences. The bill (AB 3048, Reg. Sess.), which is sponsored by the CPPA, seeks to make it “significantly easier for consumers to opt out of the sharing or sale of their personal information by requiring internet browsers to provide an opt-out preference signal that they can use to signal all of the businesses they interact with online that they are exercising their rights under the CCPA by prohibiting the businesses from sharing their personal information” (CPR, July 11).

The event is one of many hearings scheduled for next week in the Appropriations Committee, including for A.B. 1008, Reg. Sess., which would refine the definition of “personal information” under the CCPA, A.B. 2930, Reg. Sess., which would regulate the deployment and development of automated decision tools (ADTs) in California to prevent algorithmic discrimination and ensure transparency and accountability, and A.B. 2877, Reg. Sess., which is focused on the use of personal information in training artificial intelligence (AI) systems.

WHAT WE’RE TRACKING

This Month

Introduced Bills: 1

Enacted Bills: 1

Failed Bills: 1

2024 Total

Introduced Bills: 630

Enacted Bills: 56

Failed Bills/No Further Action on Adjournment: 30

MainStory: CCPA DataBreach DataPrivacy DataSecurity StateLegislation