Privacy advocates have suffered some losses in the US recently. A proposed data privacy law in Vermont, which would have been one of the strictest in the country, was vetoed by Republican Governor Phil Scott in June. And after a very convincing deception, hopes for a federal data privacy law were dashed again. But the steady march toward data dignity for all continues, with data privacy laws taking effect in Oregon, Texas and Florida earlier this month.

A brave effort in Vermont

Vermont's privacy law passed the legislature with ease, and while the bill sat on Governor Scott's desk, privacy activists across the state – and the country – held their breath until he vetoed it.

The bill would have given Vermonters the right to sue companies that allegedly violated their privacy. A key compromise was limiting the private right of action to data brokers and companies that process the data of at least 100,000 Vermonters. Still, the bill was too much for Governor Scott, and after a failed attempt to overturn the veto, the bill was killed. I hope the Vermont bill remains a starting point for discussion in future state bills.

Expanded disclosure requirements in Oregon

The Oregon State Privacy Act went into effect on July 1. A key provision includes the right of Oregon residents to request a list of third parties to whom a company has transferred data.

There is also a broader definition of “sensitive personal information” that includes national origin, transgender or non-binary status, and biometric data. The consequence is that companies must obtain consent from individuals to process this data.

Texas and Florida will also join the club on July 1

Texas and Florida's data privacy laws also went into effect on July 1. In Texas, consumer rights under the Texas Data Privacy and Security Act (TDPSA) include the right to access, delete and correct personal information, as well as the right to object to the processing of personal information for targeted advertising. The right to object also extends to cases where personal information is used to profile consumers to provide or deny protected services such as credit, housing and healthcare. Data minimization continues to be a key issue, and in Texas, data collection has been limited to what is “adequate, relevant and reasonably necessary.”

Florida's Digital Bill of Rights also went into effect on July 1, but is severely limited in scope. Florida's law took direct aim at Big Tech with its $1 billion revenue threshold and other criteria, including 50 percent of revenue from online advertising. Most companies are not affected by Florida's law, but those that are must provide consumers with the right to access, delete and correct personal data, as well as to object to the processing of data for targeted advertising.

No federal law, but other states will follow

The latest version of the federal law, the American Privacy Rights Act, was summarily withdrawn from congressional hearings earlier this month. The latest version was met with widespread opposition, with civil liberties groups like the Electronic Frontier Foundation withdrawing their support after anti-bias provisions for AI were removed, and Republicans voicing support for more “business-friendly” approaches. So, at least at the federal level, the rampant data collection and monetization of our data by big tech companies will continue for now.

Montana's law will take effect later in 2024, and in 2025, Delaware, Iowa, Maryland, Minnesota, Nebraska, New Hampshire, and Tennessee's laws will take effect. In 2025, a total of 17 states (including Florida) will have formal data privacy laws in place, and at least three more states will have them in place in 2026.

We are still in the early days of this fight for privacy rights, but it is gaining strong momentum. Individuals, regulators, and lawmakers are increasingly aware of how important privacy rights are for everyone. So for now, let's make sure we celebrate these advances in consumer protections and continue to advocate for data dignity at every level of American society.

It is up to all of us to keep the momentum going and learn from each state's different laws.

Jonathan Joseph, Board Member, The Ethical Tech Project

Leave a Reply

Your email address will not be published. Required fields are marked *