State Data Privacy Bills Growing More Widespread

A bill to establish “data rights” for Ohioans, including the ability to have personal data deleted and request it not be sold, was introduced this week in the Ohio General Assembly..

House Bill 376, known as the Ohio Personal Privacy Act, would require businesses to post privacy notices and disclose where data is sold. It also would require businesses to adhere to specified data standards. It encourages them to adopt the National Institute of Standards and Technology Privacy Framework as a standard for developing a privacy policy.

If passed, the privacy act would primarily apply to firms with $25 million or more in gross annual revenue in Ohio or businesses that control or process large amounts of data. Some companies and industries would be exempt.

Ohio Lt. Gov. Jon Husted said in a statement that the legislation is needed because of the lack of legislative action at the federal level. 

Ohio joins more than 20 states that have introduced data privacy legislation, according to Gov. Mike DeWine’s office. 

Last week, Colorado Gov. Jared Polis signed a bill giving residents the right to opt out of data collection and access and update their information, among other things. The legislation also requires companies to clearly communicate what data they collect, what they do with it, and how long they store it.

For more information about the Colorado law and other states’ privacy rights laws click here.