Data privacy advocates took a couple of losses recently in the United States. A proposed data privacy law in Vermont, which would have been one of the strongest in the country, was vetoed in June by Republican Gov. Phil Scott. And after a very convincing head-fake, hopes for a federal privacy bill were dashed, again. But the steady march towards data dignity for all continues with data privacy laws in Oregon, Texas, and Florida all taking effect earlier this month.
A valiant effort in Vermont
Vermont’s privacy law passed the legislature easily, and while the bill sat on Gov. Scott's desk, data privacy advocates across the state – and the country – held their breath, until he vetoed it.
The bill would have granted Vermonters the right to sue companies who allegedly violated their privacy. An important compromise was the limitation on the private right of action to data brokers and companies processing the data of at least 100,000 Vermonters. Still, the bill was too much for Gov. Scott, and after a failed attempt to overturn the veto, the bill died. I hope the Vermont bill remains a starting point for discussion in state bills to come.
Expanded disclosure obligations in Oregon
Oregon’s data privacy law became effective July 1. An important provision includes the right for Oregonians to request the list of third-parties in which a business has sent data.
There’s also a broader definition of “sensitive personal information” to include national origin, transgender or non-binary status, and biometric data. The consequence is that business will require opt-in consent from individuals to process this data.
Texas and Florida also join the club on July 1
Texas and Florida data privacy laws also became effective on July 1. In Texas, rights granted to consumers under the Texas Data Privacy and Security Act (TDPSA), include the right to access, delete and correct personal data, and the right to opt-out of processing of personal data for targeted advertising. The right to opt-out extends to when personal data gets used to profile consumers for the provision or denial of protected services such as lending, housing and healthcare. Data minimization continues to be an important theme, and similarly in Texas, data collection has been limited to what is “adequate, relevant and reasonably necessary.”
The Florida “Digital Bill of Rights” also became effective July 1, but it’s severely limited in scope. Florida’s law was squarely aimed at Big Tech, with its $1 billion revenue threshold and other criteria, including 50% of revenue coming from online advertising. Most businesses won’t be affected by the Florida law, but those that are must offer consumers rights to access, delete and correct personal data, and opt-out of processing of data for targeted advertising.
No federal bill no, but more states to come
The latest iteration of the federal law, the American Privacy Rights Act, was unceremoniously pulled from consideration for a congressional hearing earlier this month. The latest version was universally hated. Civil liberties groups like the Electronic Frontier Foundation withdrew support after anti-bias provisions for AI were taken out, and Republicans favored more “pro-business” approaches. So for now, at the federal level at least, rampant data collection and monetization of our data by Big Tech will continue.
Montana law will become effective later in 2024, and in 2025, we’ll see Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, and Tennessee laws become effective. In 2025 a total of 17 states will have formal data privacy laws in place (including Florida), with at least another three states in 2026
We’re still in the early innings in this fight for data privacy rights, but gaining strong momentum. There’s a growing awareness among individuals, regulators, and legislators about the critical need for data rights for all. So, for now, let’s ensure we’re celebrating these strides in consumer protection and continue to advocate for data dignity across all levels of American society.
It's on all of us to keep up the momentum and learn from all the different state laws.
Jonathan Joseph, board member, The Ethical Tech Project
