Six States Adjourn Without Passing Privacy Legislation

Last week, seven states (Oregon, Washington, Wisconsin, Florida, Wyoming, Virginia, and West Virginia) adjourned for the year. Out of this group, only Virginia was able to advance some amendments to it already existing privacy law. While Washington, Florida and Wisconsin saw a flurry of movement, disagreements and lack of time ended any hopes of passage. Washington’s HB 1850/SB 5062 and Florida’s HB 9 were of particular concern due to, among other things, their private right of action and lack of a right to cure for businesses. This is the second consecutive year in a row where both Washington and Florida were unable to move privacy legislation across the finish line.
As mentioned above, with Virginia having passed its Virginia Consumer Data Protection Act (VCDPA) in 2021, their General Assembly introduced and passed two amendments to tweak its law this session.
The passed amendments are as follows:

  1. HB 381/SB 393 - Amends Section 59.1-577 of the VCDPA related to consumers’ data deletion requests. Specifically, the amendment provides that a controller that has obtained a consumer’s personal data from a third party “shall be deemed in compliance with a consumer’s request to delete such data . . . by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer’s personal data remains deleted from the business’s records and not using such retained data for any other purpose . . . or (ii) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant” to the VCDPA.
  2. SB 534/HB 714 - Repeals the Consumer Privacy Fund and provide that all “civil penalties, expenses, and attorney fees collected pursuant to [the VCDPA] shall be paid into the state treasury and credited to the Regulatory, Consumer Advocacy, Litigation and Enforcement Revolving Trust Fund.” The bills also amend the VCDPA’s definition of “nonprofit organization” to include political organizations and any organization exempt from taxation under § 501(c)(4) of the Internal Revenue Code.”
As a reminder the VCDPA goes into effect January 1, 2023.
With more states set to adjourn in the coming months, there is a possibility we could see more activity in the privacy arena. RILA will continue to provide updates as more information becomes available.
For more information, contact Austin Gold, Director of Government Affairs.
  • Privacy
  • Public Policy
  • Supporting Free Markets and Fostering Innovation

Stay in the know

Subscribe to our newsletter