State Privacy Bills Hit With String of Defeats

Three states’ privacy bills appeared to fail in one week as legislators struggled to find agreement before their sessions ended. Washington state legislation looked dead Thursday; it hadn’t received votes as legislators neared adjournment. Florida and Wisconsin bills also stalled, and an Indiana bill could also run out of time soon. Recent privacy bill defeats show “it's tough to get a bill passed on a big-ticket item like this,” said Husch Blackwell privacy attorney David Stauss in a Thursday interview.

Florida and Wisconsin bills passed their House chambers, but their sponsors’ aides told us earlier this week that it looked unlikely they would get Senate votes before each legislature adjourned Thursday (see 2203090062 and 2203070069). Washington state Sen. Reuven Carlyle (D) wrote a eulogy for his privacy bill (SB-5062), which had been joined into a package last week with the House’s HB-1850 by the governor’s office (see 2203010058). A Senate-passed Indiana bill (SB-358) recently missed a legislative cutoff (see 2202280054); that legislature adjourns Monday.

“Equitable and robust data privacy legislation takes time,” Washington state's HB-1850 sponsor Rep. Vandana Slatter (D) said in a statement Thursday: “We’ve seen this in the EU, in California, and elsewhere. While we couldn’t get this package of data privacy legislation across the finish line this year, we did make it further than we have in previous years. … This is not the end of our work on this issue.”

Many states proposed privacy bills this year, but Utah has the only legislature to pass a bill (SB-227) through both chambers (see 2203030059). If Gov. Spencer Cox (R) signs the Utah Consumer Privacy Act (UCPA), which could happen in the next two weeks, Utah will be the fourth state to pass a comprehensive privacy law, after California, Virginia and Colorado, whose laws will take effect in 2023 (See 2202280040).

“The more a bill tries to do, the more pushback it gets,” said Stauss. Utah’s bill flew through the legislature at “record speed,” probably because "it didn't really try to do very much,” he said. Stauss has seen a push from business advocates to use Virginia’s law as a starting point, with clones appearing in many states, he said. The privacy lawyer said bills in Connecticut, Iowa and Oklahoma now seem to have the best shot of advancing.

State bills “have gotten a lot of traction” this year, emailed Information Technology and Innovation Foundation Vice President Daniel Castro. “Even the ones that have ultimately failed have often passed one chamber.” They have usually failed due to disagreement over private right of action or the scope of what businesses to include, he said. “Sometimes when bills fail legislators move on to other issues,” but that’s unlikely for the headline-generating privacy issue, he said. “It will be hard for legislators to resist taking another swing at this topic, especially if other states have passed similar laws.” Castro said he hopes continued state interest “will spur Congress to pass federal privacy legislation to avoid creating a patchwork of privacy laws.”

Florida’s bill by Rep. Fiona McFarland (R) failed for a second straight year, Shook Hardy lawyer Al Saikali blogged Wednesday. “It will be easy for some to speculate that the bill died because the House insisted on a private right of action," but that's wrong, he said. "The bill died because there were multiple differing views on the law’s scope, what activity the law should apply to, and how the law should be enforced.”

UCPA’s passage might foreshadow more states adopting Virginia’s framework for data privacy legislation, including limiting sale to monetary consideration, no private right of action and excluding personal data collected in employment and business-to-business contexts, Vinson & Elkins attorneys blogged Wednesday. Davis Wright lawyers blogged Monday, “Businesses subject to the UCPA will generally find that their compliance efforts for other state privacy laws offer a significant foundation for UCPA implementation as they build for its December 31, 2023, effective date.”

The American Civil Liberties Union declared victory Thursday in Washington state, with this year’s proposal likely dead. “For the past four years, Big Tech has tried to write its own permissive data privacy regulations into Washington law and each year privacy, consumer rights, racial justice, labor, and civil rights advocates have successfully fought back,” emailed ACLU-Washington Technology and Liberty Project Manager Jennifer Lee.

Carlyle, who's retiring, is “disappointed that the state House has failed for a fourth year to pass meaningful privacy legislation despite overwhelming popular support and near unanimous bipartisan votes in the Senate,” he said on Facebook: But he’s proud that the framework of his bill, which seemed to influence Virginia, “has now passed multiple states around the country and has influenced the global dialogue on privacy protections on every level.”