The Delaware House passed legislation that would establish data privacy rights for consumers and enhance regulations governing businesses’ use of personal online data.
Sponsored by Rep. Krista Griffith, House Bill 154, also known as the Delaware Personal Data Privacy Act, would create a framework of consumer protections, granting individuals greater control over their personal data collection and creating more transparency about how that data is used.
The bill passed with 33 yes votes with five GOP House members in the no column.
“The Delaware Personal Data Privacy Act is a critical step in safeguarding the privacy rights of Delawareans in our digital age. With the increasing collection and use of our sensitive personal data, it’s so important that we establish comprehensive rights for consumers and ensure that they have avenues to take control over their personal information,” said Rep. Griffith, D-Fairfax.
“I want to thank my colleagues in the House for passing this important piece of legislation, which will give Delawareans more control and transparency over their personal data.”
The Delaware Personal Data Privacy Act would affect companies that operate in Delaware and handle the personal information of more than 35,000 consumers or more than 10,000 consumers if they make more than 20% of their total revenue by selling personal information.
The average resident has no realistic way to track or control how their data is collected, used, or sold. HB 154 would grant Delawareans data privacy protections, including:
- The right to know whether a company is collecting and using their personal data and the ability to request access to that data, except in cases where it would reveal the company’s trade secrets.
- The right to request a company make corrections for any mistakes or inaccuracies in their personal data.
- The right to request the deletion of any personal data that the company has collected or obtained about them.
- The right to obtain a copy of the personal data that the company has processed in a format that is portable and easy to use.
- The right to opt out of certain uses of their personal data, including targeted advertising and the sale of their personal data, with some exceptions.
Companies or organizations that collect and process personal data, called controllers, would have certain responsibilities to protect consumers.
Under HB 154, controllers would be required to establish and maintain reasonable measures to protect the security and confidentiality of personal data and must obtain the consumer’s consent before processing sensitive data.
Controllers would also be responsible for providing consumers with a clear and easily accessible privacy notice that includes information about the types of personal data they collect, the purposes of data processing, how consumers can exercise their rights, and the categories of personal data shared with third parties.
If a controller sells personal data or processes it for targeted advertising, they would be required to clearly disclose this information and explain how consumers can opt out of such processing. Ten states, including Connecticut, have enacted comprehensive data privacy laws.
The bill also includes protections for children. Under HB 154, a controller would be prohibited from processing sensitive data of a child under the age of 13 unless they obtain consent from the child’s parent or legal guardian. Additionally, controllers would be obligated to obtain consent before using personal data for targeted advertising or selling the data if the consumer is between the ages of 13 and 18.
HB 154 would require the Delaware Department of Justice to engage in public outreach to educate consumers and the business community beginning at least six months prior to the effective date of the law.
The Delaware Personal Data Privacy Act would take effect on January 1, 2025 if enacted before January 1, 2024.
HB 154 now heads to the Senate for consideration.
