Delaware Personal Data Act heads to governor

The Delaware Personal Data Privacy Act was passed in the last days of the legislative session. | PHOTO COURTESY OF UNSPLASH

DOVER — The Delaware Personal Data Privacy Act, which gives consumers the right to know who is collecting their data and to opt out of targeted ads, was passed in the last days of the legislative session.

House Bill 154, sponsored by Rep. Krista Griffith (D-Fairfax), was amended to exclude registered securities brokers and dealers, as well as financial institutions that fall under the Gramm-Leach-Bliley Act. The bill as amended passed the State Senate 15-5 on June 29, and the amended bill passed the House of Representatives the following day.

Griffith told Delaware Business Times that the amendment, which was proposed by Sen. Bryan Townsend (D-Newark/Bear), was friendly and a compromise to get it over the finish line.

“Banks and financial firms are subject to the [Gramm-Leach-Bliley Act] guidelines, so there wasn’t so much heartburn in that. And shortly after the bill passed the House, FINRA reached out to us to ask to be included in the exemptions,” Griffith said.

FINRA —the Financial Industry Regulatory Authority — is a private company that acts as an independent regulator over brokerage firms and exchange markets. With the goal to ensure the United State securities operate fairly, it oversees around 3,5000 securities brokerage firms and 624,670 registered securities representatives. Under the amendment passed, registered national securities associations would also be exempt.

“I’m pleased that it passed. I know this bill caught a lot of attention from several industries for its implications. But in practice, we wanted to give power back to our consumers on how their data is used,” Griffith said. 

If signed by Gov. John Carney, the Delaware Personal Data Privacy Act would give Delawareans the right to see their personal data and know who’s collecting it, as well as giving the right to request deletion or to make changes.

Consumers would also have the right to receive a copy of the data a company has collected in a portable and easy-to-use format, unless it reveals company secrets. The Department of Justice would also conduct public outreach six months before the bill becomes law, at an estimated one-time cost of $45,000.

It also prohibits analyzing or selling data without a consumer’s consent, including those who are under 18 years old.

“That clause was important to me, because there were Big Tech lobbyists pushing to make it 16. But if you can’t sign a contract until you’re 18, then why should setting up these contractual agreements –  where you just check a box and not read the fine print – be OK?” Griffith said.

The Personal Data Privacy Act would apply to businesses that process or control the data of no less than 35,000 consumers. Companies that control and process 10,000 or less and derive more than 20% of gross revenue from selling that data would also be forced to comply. 

This is the second attempt to pass legislation regulating the sale and purchase of data of Delawareans. Last year, Griffith proposed a bill that would have required the  Department of Justice to create a registry of data brokers, or businesses that collect or maintain data from at least 500 or more consumers or those who sell or license information to businesses. That registry would have included companies’ privacy policies, opt-out information and more that Delawareans could search on their own.

HB 154 was workshopped and had 25 co-sponsors, all Democrats except Rep. Ruth Briggs King (R-Georgetown), who voiced her support for a data broker during the 2022 session.

However, Delaware business associations and technology trade associations have voiced their concerns over the low threshold of 20%, worried that it would cause undue burden on smaller entities.

“Our economy is largely driven by information, and we are grateful to our members who do their very best to protect sensitive information and use data to create things of true value,” Delaware State Chamber of Commerce Public Policy & Government Relations Director Tyler Micik said. “Passage of HB 154 is worrisome because rather than directing Department of Justice energies towards the prosecution of bad actors, this new law may stifle innovation that leads to new products and better services Delawareans have come to enjoy.”