Privacy at the state level can get messy and confusing—particularly in the current moment with the record number of proposed bills under consideration. So let’s face it: it is great to read about all those proposed bills but what US privacy professionals really want to know is which bills will pass and which bills will fail. Law firms are internally creating “2021 State Comprehensive Privacy Bill Brackets” but none are publishing them since predictions are hard and, candidly, we attorneys do like to be proven wrong.
That ends today.
The new deputy chair of SPB’s Privacy, Cybersecurity practice Alan Friel is not only a veteran of the many privacy legislation battles of the past but also a fearless leader who believes publishing our predictions will add real value to our readers (and clients).
As a reminder, SPB privacy blogs were granted the 2020 Go to Thought Leadership Award by National Review. This year we were the first major law firm to predict the Virginia Consumer Data Protection Act (VCDPA) would pass. Incidentally, our talented colleague Glenn Brown has posted great content explaining VCDPA’s requirements and even analysis comparing the right to delete under VCDPA and CCPA/CPRA (including a handy chart that you should definitely bookmark).
So, without further delay, here are the 2021 SPB’s State Comprehensive Privacy Bill predictions.
Our 2021 Final Four: Connecticut, Florida, Oklahoma and Washington
No.1: Connecticut’s Act Concerning Consumer Privacy (SB 893)
Arguably it is too early to predict the outcome of SB 893. After all, the bill is still stuck in Committee, and there were several comments filed in opposition during the February 25 public hearing. Why are we bullish on Connecticut then? The bill has the support of the Connecticut ACLU (although it is worth noting that the private right of action was removed after the ACLU expressed its support). More importantly, the Connecticut’s Attorney General Office and the Connecticut’s Senate Majority Leader strongly support the bill and Connecticut (like Virginia) is a democratic trifecta where the DNC has full control of the governorship, the state senate, and the state house. As currently drafted, Connecticut’s Act Concerning Consumer Privacy is very similar to the Virginia VCDPA (see our posting on the requirements under the VCDPA here.) The Connecticut legislature has time to reach consensus (it does not adjourn until June 9th) and we plan on keeping a close eye on developments in the state.
It has been reported that an unknown activist is behind the progress of these two Florida bills. Not surprising-this is consistent with a trend seen these past couple of years of other privacy activists similarly reshaping states’ legislative agendas. These bills are inching closer and closer to California’s CPRA in an indisputably red state, which is a remarkable development in and of itself. Florida is also the third most populous state in the nation, which means any privacy legislation enacted in the state will likely have significant sway in any future talks about federal privacy legislation. Although the Florida legislature is adjourning on April 30th, the fact that very closely aligned bills are progressing in tandem through the Senate and the House fairs well for a potential opportunity to compromise leading to enactment. We will find out soon the outcome in Florida but, in the meanwhile, here is our most recent posting on the Florida developments.
No. 3: The Oklahoma Computer Data Privacy Act (HB 1602)
Nobody seems to be paying attention to this bill but it is well-positioned to become the 2021 Cinderella Story. HB 1602 significantly differs from already enacted comprehensive privacy bills with the current version including no private right of action but featuring an opt-in consent requirement across the board before collecting, using or selling any personal information. The bill sailed through the Oklahoma house with overwhelming bi-partisan support (Ayes: 85 Nays: 11.) Oklahoma was our number one until we heard last week the chair of the Oklahoma Senate Judiciary Committee (through which the bill must pass before being brought to the floor of the Senate) may not be willing to take it up. That said, there is enough time left in the legislative calendar to build consensus and get it to the finish line (the Oklahoma legislature will not adjourn until May 28th). Oklahoma is currently a Republican trifecta, which should help avoid a governor veto. If enacted, it will be the first comprehensive privacy bill to become the law of the land in a republican controlled state and could become a viable model for other republican controlled state legislatures. For more details read our post here.
No 4: Washington Privacy Bills (HB 1433 and (SB 5062)
Washington certainly deserves “an A for effort.” The state legislature has been trying to enact the Washington Privacy Act (SB 5062) for 2 years and counting. Last year it actually enacted regulations affecting the public sector handling of personal information but consensus on enforcement effectively brought legislative progress for the private sector to a halt. In 2021 the ACLU decided to back a new bill (the People’s Privacy Act – HB 1433) and has published a chart comparing its bill to the WPA here. Why are we still optimistic on Washington? In a surprise move, on March 26 SB 5062 was amended to add a private right of action allowing state residents to sue over alleged violations. Significantly, however, the private right of action does not include a provision for monetary damages—leaving residents with the exclusive option of seeking injunctive relief (or alternatively filing a complaint with the consumer protection division of the attorney general’s office). Will this suffice to swing enough votes to get WPA through the finish line? On April 1st it passed the Civil Rights & Judiciary Committee and is now heading for the floor of the house. We will find the ultimate outcome soon (the Washington legislature is set to adjourn April 25th). Just like last year this promises to be a real nail-biter. For more information see our posting here.