The bill aims to enhance consumer privacy rights by empowering individuals to have greater control over their personal data. It outlines stringent requirements for businesses that handle consumer data, including provisions for transparency in data handling practices and mandates that businesses cannot discriminate against consumers exercising their rights under the new law. The establishment of a consumer privacy account will support enforcement activities by the state Attorney General, who is granted significant authority to investigate violations and impose fines, although no private right of action is established for consumers.
Summary
House Bill 1554 establishes comprehensive consumer data protection regulations in Indiana, set to take effect on January 1, 2024. The bill introduces a new article in the Indiana Code that defines consumer rights regarding personal data, outlines the responsibilities of data controllers and processors, and mandates data protection assessments. Key provisions include exemptions for certain types of information and data, as well as specific guidelines for handling sensitive consumer data. Notably, the bill restricts the ability of local governments to enact conflicting data privacy regulations, centralizing authority at the state level.
Contention
Discussion surrounding HB 1554 highlights varying opinions on data privacy enforcement. Proponents argue that the bill represents a necessary modernization of data protection in response to growing consumer concerns regarding data privacy and security breaches. Critics, however, express concerns over the potential implications for local governmental authority and the adequacy of consumer protections, as well as skepticism regarding enforcement capabilities and the effectiveness of the bill in genuinely safeguarding consumer information against misuse.
Minnesota Consumer Data Privacy Act modified to make consumer health data a form of sensitive data, and additional protections added for sensitive data.