State Data Privacy ‘Chaos’ Emerges Beyond Broad Consumer Laws

States are enacting similar data privacy laws when it comes to broad consumer rights but are diverging on approaches to health data, kids privacy, and other narrower issues, a panel of lawmakers and attorneys said Wednesday at a National Conference of State Legislatures panel in Indianapolis.

“What’s happening is while we see a little bit of calm in one corner of the universe in privacy law, we see chaos on the other side of that universe right now,” said David Stauss, partner at Husch Blackwell LLP.

A dozen states have enacted comprehensive consumer data privacy laws that provide people with new rights over the collection and use of their personal information, with an additional measure pending in Delaware. Most of the laws follow a similar framework, such as giving consumers the right to know what data is collected and to limit certain uses, though they differ in specifics such as what businesses are covered.

State approaches, though, deviated this year in regulating health data, such as Washington’s My Health, My Data Act, which includes the ability for individuals to sue over violations. Utah and Arkansas enacted laws this year requiring parental consent for minors to use social media, among other provisions.

New Wrinkles

Comprehensive privacy laws enacted this year also added some new wrinkles to the existing frameworks, said Keir Lamont, director of the Future of Privacy Forum’s US legislation team. Some privacy law obligations will apply to even small businesses in Texas and Connecticut, for example, unlike elsewhere, he said.

“Most of the state privacy laws entirely carved out small businesses,” Lamont said.

For lawmakers, the successful enactment of a state privacy law can take several years, said Texas state Rep. Giovanni Capriglione (R), who pushed the state’s new law this year. He recommended lawmakers in other states reach out early to groups that oppose a proposal.

A lot of the Texas bill “was making sure that it did cover the people we wanted it to cover and that we protected as many people as possible from people misusing this data,” Capriglione said.

Emerging state privacy issues include measures related to data brokers, children’s privacy, automated employment decision tools, and algorithmic discrimination, Stauss said. Connecticut is also notable for adding additional provisions on health and kids privacy to its comprehensive law this year, which may point to more states “looking and seeing what other people are doing and kind of reiterating,” he said.