There has been a lot of momentum building at the state level for states to adopt comprehensive privacy bills. The vast majority of data collected from products people use frequently is not regulated. Most companies are free to use the data they collect unless a state has a comprehensive privacy law. As of October 2022, only a handful of states (California, Colorado, Connecticut, Utah, Virginia, and Nevada) have enacted comprehensive consumer data privacy laws. No national law standardizes when a company must notify a consumer when their data has been breached or exposed to third parties. In 2022, state legislatures made several efforts to pass comprehensive data privacy bills. Lawmakers in 29 states and the District of Columbia either introduced privacy legislation or had bills carry over from 2021 into 2022. Washington and Florida tried to pass legislation but failed. Despite the immense amount of legislative activity, just two states, Connecticut and Utah, enacted laws in 2022.
In March 2022, Governor Spencer Cox signed the Utah Consumer Privacy Act into law. The Utah Consumer Privacy Act, otherwise known as the UCPA, will go into effect on December 31st, 2023. The UCPA is similar to consumer privacy laws enacted in California, Virginia, and Colorado. The UCPA draws heavy influence from the Virginia Consumer Data Protection Act and the Colorado Privacy Act. The Utah law assesses several duties on businesses that manage or process a consumer’s private data in Utah. However, in contrast to the laws of California and Colorado, the UCPA takes a comparatively business-friendly approach, making it the most market-orientated consumer privacy law to be enacted in the United States.
The issue of consumer privacy legislation has been contentious within the Florida legislature. Although Democrats and Republicans have both supported the legislation, the House and Senate have been unable to agree on enforcement rights, particularly whether enforcement should be left to Florida’s Attorney General. Additionally, many businesses are weary of data privacy legislation’s additional costs and have been vocal about their concerns. In 2022, the Florida House passed HB 9 but the Senate failed to advance the measure. Persisting disagreements and leadership changes make the enactment of such privacy legislation unlikely within the next two years.
The Washington Privacy Act, initially proposed in 2019, was poised to make Washington the second state, after California, to enact comprehensive data privacy legislation. Nevertheless, after numerous attempts over the past few years, the state of Washington ended another legislative session failing to pass data privacy legislation. The bill HB 1850 passed two House committees but was never able to garner enough support for a floor vote. A key figure in the state’s battle for privacy, Senator Reuven Carlyle retired from the Washington legislature in January. While Washington has many privacy advocates, it remains unclear whether lawmakers will continue to put privacy legislation at the forefront after Carlyle’s retirement.
Stay In Touch