As anticipated, Sen. Liz Brown (R-Fort Wayne) reintroduced data privacy legislation that would be a win for both technology companies and Indiana consumers concerned about where their data goes online and how it is used.
Her bill, Senate Bill 5, is a priority for Senate leadership. Currently, Hoosiers – and all Americans for that matter – have no federal data privacy protections or consumer rights against those who collect their information online, in the stores or at the gas pump and subsequently monetize it as part of their business operations or sell it to third parties.
This year’s version of the bill looks entirely different than the version Sen. Brown introduced last year, which was modeled after the European Union’s data protection law. Last year’s bill, Senate Bill 358, ultimately died in the House but not before undergoing reconstructive surgery to become a version that employers and consumers could agree upon. As a result, Sen. Brown made SB 5 look practically identical to SB 358 at the time of its death.
Last week, the Indiana Chamber attended a stakeholder meeting at the Statehouse to hear Sen. Brown’s strategy for getting SB 5 across the finish line this year. Representatives from the banking, health, insurance and technology industries were also present. Brown expressed her willingness to amend the bill one time to address urgent concerns but stated her preference to use the intermittent three years (before the law takes effect) to make adjustments based on lessons learned from other states, like Virginia, Colorado and Utah, which are implanting their own versions of data privacy laws.
This is the situation states are in: Without a federal solution to data privacy, states are left on their own to pass laws that balance (i) consumers’ rights to protect how their personal data is used by companies, if at all, with (ii) companies’ abilities to use the data they collect from consumers to further their business objectives. However, this patchwork approach has made it difficult for companies to ensure compliance across all states in which they conduct business.
Senate Bill 5 is modeled largely after Virginia’s law, which is favored by the business community. The main difference between Virginia’s version and others, California for example, is that enforcement authority is granted to the state’s attorney general rather than consumers having the ability to sue companies individually in court. Much like complaints against insurance companies, which are received and evaluated by the Indiana Department of Insurance, the attorney general is the first line of defense against frivolous lawsuits.
That said, SB 5 allows customers to communicate directly with companies that possess their personal data, called controllers, to stop selling their data to third parties, correct inaccuracies, obtain their own copy of that information or delete it altogether. Companies that fail to comply will be subject to strict enforcement.
In all, Sen. Brown is optimistic about the bill’s prospects this year.
Resource: Adam H. Berry at (317) 264-6892 or aberry@indianachamber.com
