Kentucky Gov. Andy Beshear (D) should veto a “weak” data privacy bill the House approved Wednesday, Consumer Reports said Thursday. The House passed HB-15 with a 94-0 vote. The Senate vote was 35-0 on March 11. The bill would grant consumer rights to access, correct and delete data and allow them to opt out of targeted advertising and sale of data. Kentucky's attorney general would have sole authority to penalize offenders under HR-15, which would go into effect in January 2026 if enacted. Consumer Reports Policy Analyst Matt Schwartz called HB-15 an “industry bill,” saying it “offers almost no new substantive limitations on how companies collect or process data.” The bill is similar to Virginia’s privacy law but lacks kids’ privacy protections the commonwealth added this year, Husch Blackwell’s David Stauss said in a blog post Thursday. The Kentucky bill treats biometric data similar to a privacy law in Connecticut, he said: Video, audio and related data isn’t considered biometric data “unless it is used to identify a specific individual.” Kentucky would become the 15th state to pass a comprehensive privacy law if Beshear signs.
Vermont could be the first state to include a private right of action in a comprehensive privacy bill. The Vermont House voted 139-0 Friday to approve H-121, which would allow individuals to sue in privacy cases and give the state's attorney general an enforcement role. The bill will go next to the Senate. Initially, the House Commerce Committee decided not to advance H-121 in 2023 after members determined it needed work (see 2304060060). But on Thursday, lawmakers amended the bill, teeing up H-121 for a Friday vote. The Commerce Committee considered privacy testimony for four years to draft a “protective but largely technology-and industry-neutral proposal,” Rep. Monique Priestley (D) said. The amended bill would align with privacy laws in Connecticut and many other states, taking some features from each, Priestley added. Some would be “unique to Vermont,” including the private right of action and restrictions on “how businesses may use data to what is consistent with the reasonable expectations of consumers,” she said. For the Computer & Communications Industry Association, the “private right of action is our main point of concern with the bill's current language,” said CCIA State Policy Director Khara Boender: “The bill otherwise is largely harmonized with existing privacy frameworks” like Connecticut’s. Private rights of action in state laws such as the Illinois Biometric Information Privacy Act “have resulted in plaintiffs advancing frivolous claims with little evidence of actual injury,” Boender said. No other comprehensive privacy bill has a broad private right of action, though the California Consumer Privacy Act has a narrower one, said Husch Blackwell privacy attorney David Stauss. Whether it survives the Vermont Senate is an open question, he said. "I certainly expect that there will be significant pushback."
The Maryland House approved a comprehensive privacy bill in a 105-32 vote Saturday. A House committee last month heard testimony on the bill (HB-567), including generally positive reviews from consumer privacy groups (see 2402140053). The Senate passed the similar SB-541 by a 46-0 vote on Thursday.
The House voted 352-65 Wednesday to approve legislation that would ban TikTok in the U.S. if Chinese parent company ByteDance doesn’t divest the app in six months (see 2403120062).
A comprehensive Minnesota data privacy bill cleared a second House committee Tuesday. The State and Local Government Committee voted by voice to advance a comprehensive privacy measure (HF-2309) to the Ways and Means Committee. Last week, the Commerce Committee approved the bill that is based on a model Connecticut and several other states adopted (see 2403050049). The Senate Judiciary Committee plans to weigh the similar SB-2915 on Wednesday. The House committee approved an amendment to HF-2309 that sponsor Rep. Steve Elkins (D) described as more “wordsmithing” based on suggestions by Google, Consumer Reports and others. Exempting airlines, the amendment also refines the definition of sale and aligns sections on data controllers’ responsibilities and implementation requirements, said Elkins. The bill drew opposition from the panel’s lead Republican, Rep. Jim Nash (R), who said he would prefer a federal law to a state patchwork. A U.S. law would be better, but federal legislation is stalled, responded Elkins. "It's been left to the states to take this on." States are “working very hard to align our bills as closely as possible … to avoid that 50-state patchwork that you described,” he said. Still, Rep. Danny Nadeau (R) complained that the Minnesota measure is "really complicated" and "confusing." Meanwhile, other state privacy bills advanced Monday. The Kentucky Senate voted 35-0 for HB-15. Kentucky's House previously approved the bill (see 2402210044) but now must concur with Senate changes. In addition, Maryland’s House Economic Matters Committee voted 14-4 to clear a privacy (HB-567) bill and 19-0 to approve a kids’ safety bill (HB-603). The committee heard the bills last month (see 2402140053).
Backers of Congress giving the FCC stopgap funding to keep the affordable connectivity program running through FY 2024 latched onto President Joe Biden's short mention of internet affordability in his State of the Union speech Thursday night to bolster that push. Biden also said Congress should pass comprehensive data privacy legislation and briefly touched on other tech policy issues. He didn't mention the House Commerce Committee's push to require TikTok Chinese owner ByteDance to divest the app for it to continue operating in the U.S., despite its supporters' rapid push to advance it (see 2403080035).
New Hampshire is the 15th state with a sweeping privacy law. Gov. Chris Sununu (R) signed SB-255 on Wednesday, which provides "transparency about what information is collected, why, and confidence that in the age of AI, steps are taken to protect that data," he said. A West Virginia comprehensive privacy bill passed the Senate on a 27-6 vote Thursday. The Senate asked the House to concur with its amendments to HB-5338. The House previously voted 91-0 for the bill (see 2402280046).
The House Commerce Committee on Thursday unanimously passed legislation (see 2403050051) that could lead to a U.S. ban on the popular Chinese-owned social media app TikTok. The legislation is poised for floor action after gaining public support from House Speaker Mike Johnson, R-La., on Thursday.
Comprehensive privacy legislation in Minnesota advanced in House and Senate committees Tuesday. In the morning, the House Judiciary Committee voted unanimously by voice to approve HF-2309 and send it to the State and Local Government Committee. In the afternoon, also on a voice vote, the Senate Commerce Committee approved SF-2915 after agreeing to harmonize its language with HF-2309. State Rep. Steve Elkins (D) said he based the House bill on a Washington state template that never became law there but that a dozen other states have since adopted. States should try to write similar laws in the absence of a federal law, which is unlikely soon, he said. One difference with other state laws is that Minnesota would include a section on automated decision-making, extending rights from the Fair Credit Reporting Act to other areas like employment and auto insurance, Elkins said. Minnesota’s bill lacks a private right of action and Elkins predicted a hefty fiscal note related to enforcement by the state attorney general. However, Elkins said the state AG office told him it can enforce the measure, if enacted. Elkins doesn’t expect any further substantive changes to the bill this session, he said.
The Utah House voted 64-0 on Wednesday for a bill that requires content filters when minors use tablets and smartphones. Eleven members were absent or didn’t vote. Because the House amended the bill, SB-104 must return to the Senate. Utah senators previously voted 25-3 in favor of the measure (see 2402070074). Meanwhile, lawmakers in other states advanced privacy and social media legislation this week. The West Virginia House voted 91-0 Wednesday for a consumer privacy bill (HB-5338) and sent it to the Senate. On Tuesday, the Georgia Senate voted 37-15 for another comprehensive privacy bill (SB-473), sending the measure to the House. On Monday, the Georgia Senate voted 51-1 for a measure requiring education for children about social media and the internet (SB-351). On Tuesday in Virginia, the House Commerce Committee voted 21-0 to advance a kids’ privacy bill (SB-361) that would add children-specific protections to the state’s comprehensive consumer privacy law. The Senate previously passed the bill 40-0 (see 2402120072). Also that day, the Missouri House Innovation Committee cleared HB-2141, which would prohibit state employees from using TikTok (see 2401030014). In Florida, the Senate Fiscal Policy Committee approved SB-1448 Tuesday, requiring platforms that foreign adversaries own to disclose how they curate, personalize and target content and how they address misinformation and harmful content. A House version of the bill advanced last week (see 2402220051).