DOVER — The Delaware House of Representatives has passed the Data Act mostly along party lines, while some representatives stressed that the measure would have the unintended consequences of hurting small businesses.
House Bill 262 was met with questions and requests for clarification from Republican representatives ahead of the vote on May 5, mainly focusing on how it would impact larger corporations that tend to favor the First State compared to smaller businesses that may collect data.
The bill ultimately passed 37-13, mostly falling on party lines. Rep. Ruth Briggs King (R-Georgetown) was the lone Republican who lent her support to the bill, and later became one of its co-sponsor. Rep. Jeff Spiegelman (R-Townsend/Clayton) was absent for the vote.
“As Americans and consumers, we have very little control on how our data is being used, yet too often we click ‘yes’ on privacy policies when we go into an app or on a website, without understanding the use of our information,” said Rep. Krista Griffith (D-Fairfax), the sponsor of HB 262, in a statement. “This bill bridges the gap, providing transparency so consumers can track who has their personal information. People want to know who is selling their Social Security number, maiden name and other information. If people are making money off of that, consumers should be the first to know.”
The Data Act would require the state Department of Justice to create a registry of data brokers, or businesses that collect or maintain data from at least 500 or more consumers or those who sell or license information to businesses. That registry would include companies’ privacy policies, opt-out information and more that Delawareans could search on their own. Companies can be held liable if they knowingly buy data that was fraudulently acquired.
In simpler terms, this bill intends to spell out which companies are allowed to collect and sell data if a Delawarean checks the “yes” box on terms of use.
For example, credit rating agencies or identity protection firms may have a sister company that sells data collected from consumers, explained state Department of Justice Fraud and Consumer Protection Division Director Owen Lefkon. He testified before the House on the bill as an expert witness.
“If you’re engaging with credit rating agencies, they may have subsidiaries where they are buying data that is not regulated under the federal law,” Lefkon told representatives. “None of that is readily accessible, or perhaps even accessible at all, to a consumer … consumers don’t know, and so they’re not in a position to make complaints.”
Registration fees for the state registry would range between $10 to $500, and be based on the company’s activities and how fast they sell or license the data. Those who fail to register will be fined $50 each day to not exceed a total of $10,000 for each year.
The Data Act is not limited to companies in Delaware, but any company that “interacts with Delaware consumers,” when it comes to buying and selling Delawareans data, Lefkon added. It is difficult to estimate how many companies would have to register, though he predicted it would impact 2,000 to 3,000 companies.
Rep. Richard Collins (R-Millsboro) disagreed with that estimate, and predicted the state would have exponentially more companies to monitor. He questioned whether more staff would be needed to handle the registry compared to the deputy attorney general and paralegal the DOJ has proposed.
Collins also warned the bill, which based on similar legislation in Vermont, would be a deterrent for companies to continue to incorporate in Delaware.
“Folks, this is a bad idea. We need to think about what we’re doing. We are the state of business. If we were to lose the franchise tax business folks, we will have an economic catastrophe on our hands,” he said.
Rep. Bryan Shupe (R-Milford) believed the bill would have a larger impact on smaller businesses. For example, a small gym with partnership with a national firm to market specific products through their platforms would still have to register.
“My concern is that we’re going to get a lot of national international companies who deal with Delaware residents, and they’re going to say, ‘Who cares? A $50 fine is not worth my time to pick it off the floor,” Shupe said. “This is going to add a lot more regulation to our Delaware businesses versus our others.”
The Delaware DOJ has yet to develop a plan to address non-compliant companies, if the bill is passed.
HB 262 now heads to the Senate Banking, Business & Insurance Committee for a hearing. State Sen. Stephanie Hansen (D-Middletown) will now lead the bill’s efforts throughout the Senate.
