W.Va. Legislature looking at data privacy law
Trending
CHARLESTON -- Lawmakers are wanting to add West Virginia to the more than a dozen states that protect the privacy of digital information for citizens.
Members of the Joint Standing Committee on the Judiciary received a briefing Tuesday morning on legislation set to be introduced during the Legislature's 2024 regular session in January to protect data privacy. The briefing was part of the final day of December interim meetings at the Capitol.
The draft bill, similar to House Bill 3498 introduced earlier this year during the 2023 legislative session, would establish the Consumer Data Protection Act. The goal of the proposed legislation is to establish limitations on businesses or other entities that collect or sell personal information.
The Consumer Data Protection Act would establish regulations and rights for access to digital data, correcting data, deleting data, the ability to move data, and the right to opt out of personal data collection. The bill would include stronger regulations when it comes to digital data of children.
According to a staff attorney, 13 states have implemented data privacy laws over the past five years. But while the states are taking the lead on data privacy, the differing laws are creating a patchwork of regulations for companies to navigate.
California was the first state to implement a data privacy law, the California Privacy Rights Act, after a ballot initiative in 2020 amended the state's Consumer Privacy Act. Other states include Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. Another 10 states are considering similar legislation.
The Consumer Data Protection Act is modeled after the Virginia legislation which went into effect this year. The bill limits the regulations in the bill to businesses that control or process the personal data of at least 100,000 people or earn more than 50% of their income from the sale of personal data for at least 25,000 consumers. While some West Virginia companies might fall within those limits, the bill is primarily aimed at larger out-of-state corporations.
The bill limits the collection of personal data by private sector businesses to what is adequate, relevant, reasonable, and necessary; that companies implement security practices to safeguard the data; that the companies provide ways for consumers to reach out to the companies to exercise their rights regarding their personal data; and provide consumers with privacy notices. The bill would not apply to state and local governmental entities.
The bill would provide consumers with the right to opt out of the processing of personal data for the purposes of targeted advertising. The attorney general is given exclusive authority to enforce the Consumer Data Protection Act similar to the office's authority under the Consumer Protection Act and gives consumers the ability to contact the attorney general to obtain relief.
Amy Cyphert, a lecturer at the West Virginia University College of Law, provided a briefing to the committee about the best practices for online privacy legislation. She said that a lack of federal legislation on data privacy has caused states to create their own laws.
"There is this sort of federal vacuum that is creating a need for you to act at the state level," Cyphert said. "There is no comprehensive federal consumer privacy law. And because of that, there is this vacuum and states are filling it because they need to protect their citizens. That, of course, is complicated for those who need to comply with the patchwork of laws that exist across the country."
Sen. Mike Stuart, R-Kanawha, asked Cyphert about whether there was a need to include provisions in a future bill to ensure that companies cannot avoid complying with law enforcement requests for personal electronic data.
"We see certain social media sites that are super highways of criminal activity," Stuart said. "I know we've seen threats in the past of total encryption from some of the social media companies. What are you seeing in terms of state action, federal action in terms of ensuring law enforcement the information it needs to be able to prosecute those with respect to human trafficking, selling drugs, other contraband, other illegal activity?"
Cyphert said that Section 230, part of the federal Communications Decency Act, already provides carve outs for tech companies to comply with law enforcement requests for personal information under certain exceptions. But she said the federal government is slow to update its laws as technology changes and adapts.
"I think that there is a lack of activity at the federal level for things like updating these laws, some of which have been on the books now for 20 some years," Cyphert said. "It's a very different social media landscape than what was in existence when things like Section 230 was passed. I think there needs to be more action."