DOVER – Recognizing the need to protect the privacy and security of personal data in the digital age, lawmakers have filed legislation that would establish data privacy rights for consumers and enhance regulations governing the use of personal online data by businesses.
Sponsored by Rep. Krista Griffith, House Bill 154, also known as the Delaware Personal Data Privacy Act, would create a comprehensive framework of consumer protections, granting individuals greater control over their personal data collection and creating more transparency about how that data is used.
“The Delaware Personal Data Privacy Act is a critical step in safeguarding the privacy rights of Delawareans in our digital age. With the increasing collection and use of our sensitive personal data, it’s so important that we establish comprehensive rights for consumers and ensure that they have avenues to take control over their personal information,” said Rep. Griffith, D-Fairfax.
“This legislation will give them that control and provide much-needed transparency and accountability in the use of personal data by companies.”
The Delaware Personal Data Privacy Act would affect companies that operate in Delaware and handle the personal information of more than 35,000 consumers or more than 10,000 consumers if they make more than 20% of their total revenue by selling personal information.
Currently, the average resident has no realistic way to track or control how their data is collected, used, or sold. HB 154 would grant Delawareans numerous data privacy protections, including:
- The right to know whether a company is collecting and using their personal data and the ability to request access to that data, except in cases where it would reveal the company’s trade secrets.
- The right to request a company make corrections for any mistakes or inaccuracies in their personal data.
- The right to request the deletion of any personal data that the company has collected or obtained about them.
- The right to obtain a copy of the personal data that the company has processed in a format that is portable and easy to use.
- The right to opt out of certain uses of their personal data, including targeted advertising and the sale of their personal data, with some exceptions.
“Digital privacy is about more than what the websites we visit and the products we buy online. Everything from the thermostats in our homes to our fitness trackers on our wrists now produce data that can be sold, shared and hacked,” said Senate Majority Leader Bryan Townsend, D-Newark/Bear, the lead Senate sponsor for HB 154.
“Congress has yet to pass a comprehensive law governing data privacy, leaving the states to protect consumers the best we can. The legislation we are introducing today is a major step forward that will help to give Delawareans more power over who owns their personal information and how it can be used.”
Companies or organizations that collect and process personal data, called controllers, would have certain responsibilities to protect consumers.
Under HB 154, controllers would be required to establish and maintain reasonable measures to protect the security and confidentiality of personal data and must obtain the consumer’s consent before processing sensitive data.
Controllers would also be responsible for providing consumers with a clear and easily accessible privacy notice that includes information about the types of personal data they collect, the purposes of data processing, how consumers can exercise their rights, the categories of personal data shared with third parties, and the controller’s contact information.
If a controller sells personal data or processes it for targeted advertising, they would be required to clearly disclose this information and explain how consumers can opt out of such processing. Eight states, including Connecticut, have enacted comprehensive data privacy laws.
“A typical consumer hands personal data over to businesses each day, but that’s just the tip of the iceberg. Beneath the water, your data is then bought and sold by a gigantic industry that stockpiles, refines, and resells it to advertisers and others.” said Attorney General Kathy Jennings.
“This is a booming industry that exploits the fact that Delawareans — including and especially our kids — are not guaranteed basic rights to learn about and protect their personal data. I’m grateful to Rep. Griffith for championing one of the most robust, forward-thinking consumer protection bills in our state’s history.”
To ensure that consumers and businesses understand the data privacy changes, HB 154 would require the Delaware Department of Justice to engage in public outreach to educate consumers and the business community beginning at least six months prior to the effective date of the law.
The Delaware Personal Data Privacy Act would take effect on January 1, 2025 if enacted before January 1, 2024. HB 154 has been assigned to House Technology & Telecommunications Committee.
###