House Bill 154 for the Delaware Personal Data Privacy Act was introduced, on 12 May 2023, to the Delaware House of Representatives, and thereafter assigned to the Technology and Telecommunications Committee on the same date. In particular, the bill would apply to entities that conduct business in Delaware and that:

• control or process the personal data of not less than 35,000 consumers; or
• control or process the personal data of not less than 10,000 consumers and derive more than 20% of their gross revenue from the sale of personal data.

In addition, the bill includes definitions of key terms, such as biometric data, child, consent, consumer, and dark patterns. Moreover, the bill delineates consumers' personal data rights, such as the right to know what information is being collected about them, to correct any inaccuracies, to request deletion of their personal data that is being maintained by entities or people, and to opt out of the processing of their personal data for purposes of targeted advertising, sale, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning them.

Furthermore, the bill would impose obligations on controllers, including the obligation to:

• limit the collection of personal data to what is adequate, relevant, and reasonably necessary;
• establish, implement, and maintain reasonable administrative, technical, and physical data security practices;
• not process sensitive data concerning a consumer without obtaining the consumer's consent;
• provide an effective mechanism for a consumer to revoke their consent; and
• conduct and document, on a regular basis, a data protection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer, if the controller controls or processes the data of not less than 100,000 consumers.

Additionally, the bill establishes that the Department of Justice has sole enforcement authority for violations of its provisions.

Lastly, the bill provides that it shall enter into effect on 1 January 2025, if enacted before or on 1 January 2024, or, if enacted after such date, on 1 January 2026.

You can read the bill here and track its progress here.

UPDATE (9 June 2023) 

Bill on personal data privacy passes House

The bill was passed by the House of Representatives, on 8 June 2023, and on the same date, referred to the Banking, Business, Insurance & Technology Committee in the Delaware State Senate.

You can read the bill here and track its progress here.

UPDATE (29 June 2023)

Bill on personal data privacy amended and reported out of committee

The bill was amended, on 27 June 2023, and reported out of the Banking, Business, Insurance & Technology Committee, on the following day. Subsequently, the bill was assigned, on the same date, to the Senate Finance Committee. In particular, the amendments to the bill changed the definition of 'publicly available information' to include information that is lawfully made available through federal, state, or local government records and information that a controller has a reasonable basis to believe that the consumer has lawfully made available to the general public through widely distributed media.

In addition, the amendments to the bill provide that a national securities association is not subject to the bill and that data subject to the Gramm Leach-Bliley Act (GLBA) is also not subject to the bill. 

You can read the bill here and track its progress here.

UPDATE (30 June 2023)

Bill on personal data privacy passed by Senate

The bill was passed, on 29 June 2023, by the Senate and sent back to the House for further consideration.

You can read the bill here and track its progress here.

UPDATE (3 July 2023)

Bill on personal data privacy passed by the House and sent to Governor

On June 30, 2023, the bill was passed by the House and will now be sent to the Governor for signature.

You can read the bill here and track its progress here.

UPDATE (15 September 2023)

Governor signs Personal Data Privacy Act

On September 11, 2023, the Personal Data Privacy Act was signed into law by the Governor. 

The Act enters into effect on January 1, 2025.

You can read the Act here and view its legislative history here.