Key point: Utah is set to become the fourth state to pass consumer privacy legislation, while Florida’s bill now goes to a single chamber.
There were two significant developments in state privacy law on March 2, with the Utah Senate passing SB 227 and the Florida House passing HB 9. Below updates on both bills.
Utah is set to become the fourth state to pass consumer privacy legislation. For reference, last week the Utah Senate unanimously passed SB 227 – the Utah Consumer Privacy Act. The House amended the bill slightly before passing it unanimously on March 2. The bill now returns to the Senate for passage. The Utah Legislature closes on Friday, March 4, so final passage will happen quickly.
According to the Utah Legislature website, after approval, the bill will be signed by the president and president, registered, and delivered to the governor. The governor has 20 days from the adjournment to sign the bill, to not sign the bill (when it becomes law), or to veto the bill.
The bill is based on the Virginia Consumer Data Protection Act (VCDPA) but is much more business-friendly. Here are some takeaways:
- The bill applies to controllers or processors who conduct business in the state or produce a product or service for consumers who are residents of the state, have an annual income of $25,000,000 or more and (1) controls or processes the personal data of 100,000 or more consumers per year or (2) derives more than 50% of its gross revenue from the sale of personal data and controls or processes the personal data of 25,000 or more consumers .
- The bill includes broad exemptions for employee data, nonprofit organizations, higher education institutions, covered entities and business associates, personal health information, and regulated entities and data. GLBA, among others.
- The definition of sale do not include “other monetary consideration”. The definition of sale also contains the following exemption, “taking into account the context in which the consumer provided the personal data to the controller, the disclosure by a controller of the personal data to a third party if the purpose is in accordance with the reasonable expectations of the consumer”. This exemption is not found in the laws of California, Colorado or Virginia.
- The bill allows privacy rights similar to those of the VCDPA, but limits the right to delete personal data that the consumer has provided to the controller (excluding any personal data that the controller has obtained on the consumer). The bill does do not allow the right to refuse profiling.
- The bill defines sensitive data but does not do not require consumer consent for the processing of such data, as do the Colorado Privacy Act (CPA) and the VCDPA. Rather, it states that a “controller may not process sensitive data collected from a consumer without first presenting the consumer with clear notice and an opportunity to opt out of the processing.”
- The bill requires consent only in the context of parental consent for the processing of children’s data. The definition of consent do not include dark patterns.
- Controllers are required to enter into data processing agreements with processors, but the bill do not contain all the requirements of the CPA and VCDPA. For example, there is no obligation for processors to allow or contribute to reasonable audits and inspections by the controller or the auditor designated by the controller.
- Controllers are required to provide consumers with privacy notices.
- The bill does do not require data processing assessments, as do the CPA and VCDPA.
- The bill does do not require controllers to recognize non-participation signals, as the CPA does.
- There is no private right of action. The attorney general’s office would enforce the bill. The bill includes a 30-day healing right that does not do not sunset.
- The effective date is December 31, 2023.
In Florida, the House passed Rep. McFarland’s HB9 103 to 8. The bill is now in the Senate and has been referred to the Judiciary Committee. Last year, the House and Senate both passed bills but could not reconcile their differences before the legislature adjourned. The Florida legislature adjourns on March 11.[View source.]