DE lawmakers aim to protect consumers’ personal data with new legislation

May 16, 2023

Han Cechini,

DELAWARE – Whether you like it or not, your personal data is for sale. Delaware lawmakers are trying to change who has access to it, and what happens with the data once an entity buys it.

Protecting Consumers

The Delaware Personal Data Privacy Act would affect companies that operate in the First State, and handle the personal information of more than 35,000 consumers. Companies that handle the data of more than 10,000 consumers, and make more than 20% of their total revenue by selling personal information, would also be included.

“Consumers are decades behind where companies are, in terms of the use of information, and where personal data is used, how it’s being used,” said bill sponsor Representative Krista Griffith. “Be it [consumers’] name, their social security number, their mother’s maiden name, biometric data, sensitive data; this legislation is a wide-reaching bill that really does seek to give Delawareans something that they’ve never had, which is control over their personal information.”

Under the bill, consumers would be entitled to the following:

The right to know whether a company is collecting and using their personal data
The Ability to request access to that data, except in cases where it would reveal the company’s trade secrets.
The right to request a company make corrections for any mistakes or inaccuracies in their personal data.
The right to request the deletion of any personal data that the company has collected or obtained about them.
The right to obtain a copy of the personal data that the company has processed in a format that is portable and easy to use.
The right to opt out of certain uses of their personal data, including targeted advertising and the sale of their personal data, with some exceptions.

Holding Controllers Accountable

The companies buying and using consumers’ personal data, or controllers, would also be held to higher standards. Controllers would be required to establish and maintain measures to protect security and confidentiality of personal data, and must get consumers’ consent to process sensitive data.

Organizations would also be tasked with providing consumers clear, and easily accessible privacy notices; those would include information about the types of personal data controllers collect, why they’re processing it, how consumers can exercise their rights, the categories of personal data shared with third parties, and the controller’s contact information.

If a controller does sell personal data, or process it for targeted advertising, they would have to clearly communicate that with consumers, and provide them with the option to opt out of processing.

“We deserve rights to protect that information, we deserve to know who has the information, what that information is, if it’s wrong or inaccurate the right to correct that information, and ultimately, perhaps even the right to have the company delete it,” said Rep. Griffith. “If the company is non-compliant, then the individual can go to the Delaware Department of Justice [DOJ], where that complaint would be investigated.”

And, Rep. Griffith says, the implications of this bill could reach much further than Delaware.

“If the company is out of state, but they still have 35,000 or more [Delaware] consumers’ information, then the law would apply to them,” said Rep. Griffith. “So, it does help those consumers who are using apps from out of the state, or other businesses or corporations.”

Looking Ahead

It’s important to note, this bill does come with a price tag. Rep. Griffith says at least four people would be required to work those investigations at the DOJ. And, lawmakers are planning for an education and outreach campaign, which could incur some one-time costs.

“The key provision is, we do want to make sure that we’re educating the public and the business community about the bill,” said Rep. Griffith.

The fiscal note for the bill is expected to be released in the coming days. Until then, the bill has been assigned to House Technology & Telecommunications Committee. If passed by January 1st, 2024, the legislation would go into effect on January 1st, 2025.