Draft Legislation Previewed On Consumer Data Protection

Last year’s House Bill 3498, the Consumer Data Protection Act, did not move past the House of Delegates Finance Committee. The revamped legislation would establish limitations on businesses or entities that buy and sell data information.  

House of Delegates Counsel Brian Casto told members of the interim Joint Standing Committee on the Judiciary Tuesday that the bill targets larger, private sector, for-profit multi-state or international corporations. 

“It limits the application of this bill to businesses that process the personal data of 100,000 persons or more, or which derive 50 percent of their gross revenue from the sale of personal data for at least 25,000 consumers,”  Casto said. “There are very few businesses within the state who would actually fall under that number.”

The bill puts limitations on collecting personal data, requires strict security measures, and allows consumers to access, correct, delete and obtain a copy of their personal data. The bill clarifies that these standards do not apply to state and local government entities.

Casto said the bill also gives consumers the right to “opt out” of targeted advertising. 

“Obviously, advertising and the sale of data for revenue purposes is a major revenue stream for many of these businesses,” Casto said. “We are giving consumers the right to opt out.”

Casto said the Attorney General, as opposed to any private sector legal representation, will have the exclusive authority to enforce the law.

“This is an enforcement power that is similar to the Attorney General’s power with other consumer protection laws that we have on the books,” Casto said. 

West Virginia would be the 14th state to enact data protection legislation.

The committee invited West Virginia University College of Law Professor Amy Syphert to talk about national trends and online privacy legislation.

“There is a sort of federal vacuum that is creating a need to act at the state level,” Syphert said. “Some privacy laws at the federal level are fairly well known such as the Family Educational Rights and Privacy Act (FERPA), which deals with educational records privacy, the Health Insurance Portability and Accountability Act (HIPAA), which is about health information and the Children’s Online Privacy Protection Act (COPPA), for children’s online privacy. But there is no comprehensive federal consumer privacy law.” 

Syphert talked about concerns with certain types of data, more than others.  

“For example, Montana’s consumer data privacy act defines personal data,”  she said. “It has a subcategory of sensitive data. Personal data is any kind of information linked or reasonably linkable to an identified or identifiable individual. But then there’s sensitive data, which includes information about, you know, ethnic origin, or immigration status, or health, other things like that, including information about children or geolocation data.”

Syphert said California was the only state to allow limited private right of action, which allows consumers to seek statutory damages, rather than West Virginia’s proposed Attorney General’s office as exclusive prosecutor. 

Syphert said some states do require that consumers actively “opt in” via consent, before their data can be processed, especially when that data has been designated as sensitive data. 

“For example, Connecticut’s data privacy act, says companies will not process sensitive data concerning a consumer without obtaining the consumer’s consent,” Syphert said.

Del. Tom Fast, R-Fayette, asked Casto about the feasibility of West Virginia law including an “opt in” requirement, keeping consumers off data rolls unless permission is granted to be there.    

“I think it’s an approach that could be tried,” Casto said. “I don’t think that there’s anything legally inherently wrong with it. I think the arguments you’re going to hear are going to focus mainly on practicality because you’re going to have an extraordinary amount of data traffic back and forth.” 

Sen. Mike Stewart, R-Kanawha, asked Syphert about exemptions on data access restrictions for law enforcement in combating criminal activities like human trafficking.

“I think, especially when it comes to social media, there are carve outs for things like human trafficking from laws that protect consumers,” Syphert said. “There are laws that protect social media companies from certain types of lawsuits and other enforcement actions. And there are clear carve outs for things like trafficking. I think that that’s still unclear and in an evolving area.”