Cybersecurity Policy Report, The Week in State Privacy and Cybersecurity Legislation—Mar. 4-8, 2024, (Mar 11, 2024)

By WK Editorial Staff

Welcome to The Week in State Privacy and Cybersecurity Legislation, your weekly update on the latest developments in proposed and amended privacy and data security legislation across the 50 states and the District of Columbia, as well as a summary of what's on the schedule for the coming week. For comprehensive status and summaries of all state privacy and cybersecurity bills in play this year, please consult the State Privacy and Cybersecurity Legislation Tracker, located in the Spotlight Topics panel on the Wolters Kluwer Cybersecurity & Privacy dashboard.

Last week, New Hampshire finalized its comprehensive privacy and data protection law, and several other states advanced similar proposals in the legislative process, among other developments.

RECENT DEVELOPMENTS

New Hampshire adopts comprehensive privacy law. On March 6, New Hampshire Gov. Chris Sununu (R.) signed SB 255, which makes the state the second this year to enact a comprehensive privacy and data protection law this year (after New Jersey) and the 14th state overall. Among other provisions, the new law, which takes effect Jan. 1, 2025, will give consumers the right to confirm if a controller is processing their personal data, as well as data correction, deletion and portability rights, and the right to opt out of processing for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of automated decision making (CPR, March 7).

Maryland Senate committee approves Consumer Online Data Privacy Act. The Maryland state Senate Finance Committee voted on March 7 to approve SB 541, the state’s proposed comprehensive privacy law. The bill seeks to regulate the manner in which a controller or a processor may process a consumer’s personal data; authorize a consumer to exercise certain rights regarding their personal data; and require a controller of personal data to establish a method for a consumer to exercise certain rights related to personal data (CPR, March 7). The bill was subject to a motion to lay over and is pending further review in the Senate.

Consumer Data Privacy Act approved by Minnesota Senate committee. On March 7, the Minnesota state Senate Commerce and Consumer Protection Committee passed SF 2915, a bill that would confer consumer rights and impose controller and processor obligations similar to other states’ comprehensive privacy laws. Among other provisions, the bill requires data protection impact assessments under specified conditions and vests enforcement in the attorney general’s office (CPR, March 7). The bill has been re-referred to the Senate Judiciary and Public Safety Committee, where it will have a hearing on March 13.

Bill restricting social media companies clears Florida House. In a 109-4 vote on March 6, the Florida state House passed HB 3, a revamped bill that seeks to protect children online (CPR, March 7). The revised measure passed a Senate vote on March 4 (CPR, March 5), just days after Gov. Ron DeSantis (R.) vetoed a similar bill (HB 1) that sought to require social media platforms to essentially prohibit children under the age of 16 from creating accounts (CPR, March 1). HB 3, which is awaiting action from Gov. DeSantis, would, according to Florida House Speaker Paul Renner (R.), include “critical parental controls” and “enforce stronger penalties against social media companies that continue to disregard the well-being of children.”

Amendments to VA CDPA on children’s privacy protection clear legislature. On March 4, the Virginia state Senate voted unanimously to approve HB 707, a bill that would amend the state’s Consumer Data Privacy Act to prohibit the processing of personal data of a known child for specified purposes, including targeted advertising, sales of data, or profiling, as well as processing for any purposes other than that originally stated, without parental consent (CPR, March 5). The bill, which passed the state House on Feb. 6, has been signed by the House Speaker and Senate president and is now awaiting action from Gov. Glenn Youngkin (R.).

WHAT’S COMING UP

On March 12, the Minnesota state House State and Local Government Finance and Policy Committee will review HF 2309, one of two comprehensive privacy bills now under consideration in the House (see above regarding SF 2915).

Also on March 12, the Vermont state House Commerce and Economic Development Committee will consider HB 121, that state’s version of a comprehensive privacy bill; in fact, the bill is on the committee’s schedule for each day between March 12 and March 15.

Maine’s Joint Judiciary Committee will meet on March 14 to discuss several privacy-related proposals pending in the state, including the following:

1. LD 1973, the proposed Maine Consumer Privacy Act;

2. LD 1977, which would create the Maine Data Privacy and Protection Act;

3. LD 1902, a proposal to enact provisions protecting the privacy of health data; and

4. LD 1705, which would impose consent requirements prior to the collection of sensitive personal data.

In Alaska on March 15, the state House Labor & Commerce Committee will review HB 271, a bill that would prohibit social media providers in the state from permitting a minor to open or maintain an account without obtaining consent from the minor’s parent or legal custodian.

WHAT WE’RE TRACKING

Last Week:

Introduced Bills: 3

Enacted Bills: 1

Failed Bills: 5

2024 Total (including carryforward)

Introduced Bills: 564

Enacted Bills: 4

Failed Bills: 12

MainStory: DataPrivacy DataSecurity StateLegislation