Gov. John Carney held a quiet bill signing ceremony earlier this week where he signed the Delaware Personal Data Privacy Act into law. | DBT PHOTO BY JACOB OWENS
WILMINGTON — Gov. John Carney signed the Delaware Personal Data Privacy Act on Monday afternoon, giving Delawarans the right to access their personal data and know who’s collecting it.
House Bill 154 was sponsored by Rep. Krista Griffith (D-Fairfax), and the governor’s signature represents the culmination of her two-year campaign to give consumers power back on how their personal data was being used in the information age.
Delaware is now the latest state with a comprehensive data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas and Florida.
The law goes into effect on Jan. 1, 2025. The Delaware Department of Justice (DOJ) will launch a one-time outreach effort no later than July 1, 2024.
“It’s exciting to get to this point, and it’s certainly important to have this tool available to Delawareans,” Griffith told the Delaware Business Times. “When I was out and about over the year, I had asked lots of people about this issue – and it didn’t matter who I was speaking to, couples, seniors, teenagers. They all thought they should be permitted to know how their data is processed, used and sold.”
Under the Delaware Personal Data Privacy Act, consumers are granted the right to know what information is being collected and see it — and correct or request to delete it. Consumers will also have the right to receive a copy of the data in a portable and easy-to-use format, unless it reveals company secrets. People can opt out of companies processing personal data for purposes of targeted advertising and sale of data.
Companies would have 45 days to respond to consumers rights requests, with the potential of an extension in certain circumstances.
It also prohibits analyzing or selling data without a consumer’s consent, including those who are under 18 years old.
“We were actually the first to include a clause for teenagers, although Connecticut did a clean-up bill to add it and I believe other states are considering it as well,” Griffith said. “If teenagers cannot be expected to enter into any other contract, why should it be different for terms of use?”
The Personal Data Privacy Act would apply to businesses that process or control the data of no less than 35,000 consumers. Griffith noted that the population scope was tailor-made for the First State, which has a population of just over a million people.
“We were very careful to make sure this threshold [of 35,000 consumers] worked for small businesses, but also it was enough to serve as guardrails for our small state,” Griffith said.
Companies that control and process data from 10,000 or fewer customers but derive more than 20% of gross revenue from selling it would also be forced to comply. That clause mirrors similar states like Virginia’s law (50% of gross revenue) and Connecticut (25%).
HB 154 does not apply to securities brokers and dealers, as well as financial institutions that fall under the Gramm-Leach-Bliley Act. The Financial Industry Regulatory Authority, a private company that acts as an independent regulator over brokerage firms and exchange markets, also successfully lobbied to exempt registered national securities associations would also be exempt.
The Delaware DOJ has the right to exclusively enforce the Delaware Personal Data Privacy Act, and offers a 60-day cure period for violations until the end of 2025. If companies do not comply with a violation, the justice department can proceed with enforcement.
The state DOJ will hire four full-time employees to manage enforcement, including two deputy attorneys general, a legal assistant and an administrative management analyst.
Delaware business associations and technology trade associations have voiced their concerns over the threshold, worried that it would cause undue burden on smaller entities.
“Our economy is largely driven by information, and we are grateful to our members who do their very best to protect sensitive information and use data to create things of true value,” Delaware State Chamber of Commerce Public Policy & Government Relations Director Tyler Micik told DBT in June. “Passage of HB 154 is worrisome because rather than directing Department of Justice energies towards the prosecution of bad actors, this new law may stifle innovation that leads to new products and better services Delawareans have come to enjoy.”