The start of 2023 saw the list of states who have already passed data privacy legislation grow to six when Iowa signed its bill into law. The states now include:

1. Iowa (as of March 2023)
2. California
3. Colorado
4. Virginia
5. Utah
6. Connecticut

In addition, as of April 2023, twenty-four U.S. states had proposed comprehensive privacy legislation during this session alone.

The chart below lays out the spread of states prioritizing this action -- and, as you can see, they represent a wide range of political ideologies, reminding us that there's strong bipartisan agreement on the need for data privacy legislation, even if the logistics around how it's accomplished haven't yet met every state's demands.

Notably, Iowa's legislation passed when it was reintroduced this year after it stalled in the Senate just last year. We're seeing many states -- Indiana, Kentucky, Mississippi, New York, Oklahoma, Oregon, and Tennessee -- reintroduce revised bills after they failed previously, indicating consistent resolve to find a solution.

What is Private Right of Action?

One of the biggest controversies in some proposed state legislation is the inclusion of private right of action clauses.

What does private right of action mean? A private right of action allows a private plaintiff to bring a lawsuit against a specific company or organization instead of waiting on the state Attorney General to press charges.

Though it was eventually walked back, Oregon's now-approved SB619 bill once contained these allowances:

• It permitted the Attorney General to investigate violations of the bill and bring action to seek civil penalties of up to $7,500 for each violation; and
• It permitted a consumer, or class of consumers, to bring an action for ascertainable loss of money or property resulting from violations of SB 619.

So far, we've seen both Oregon and New York propose this and subsequently walk it back in the interest of getting legislation passed.

Oregon's original version of the bill materialized after what sponsor Sen. Floyd Prozanski (D) called “significant discussion” on whether to keep it, indicating the state landed on its importance. 

As we see more states draft their own solutions to data privacy -- in the current absence of a federal bill -- the inclusion of this right of action will be one to note.

As Consumer Reports puts it: "Given the AG’s limited resources, a private right of action is key to incentivizing companies to comply. Further, it’s appropriate that consumers are able to hold companies accountable in some way for violating their rights. ... Empowering consumers to obtain injunctive relief and costs is a significant step forward."

--

Take next steps to be prepared for the impact of privacy from both the legislative and tech response perspectives. 

• Get customized support for your team.
• Take my online course to help practitioners understand the steps to take right now.