Indiana Consumer Privacy Bill Clears the Senate Unanimously
It is expected to be another big year for privacy laws as many states will look to join California, Virginia, and Colorado in passing comprehensive privacy laws. Already 12 states, including Ohio and Kentucky, have introduced comprehensive state privacy laws. The first big movement of 2022 came in Indiana, where earlier this week, SB 358 unanimously cleared the Indiana Senate.
The Senate’s approval of the bill which mirrors the Virgina Consumer Data Protection Act, comes after the bill was replaced by a prior version that was similar to the more onerous California Consumer Privacy Act.
Senate Bill 358 features expansive consumer rights and compliance requirements for businesses. The bill would provide consumer rights such as the right to request that data be disclosed, deleted, or corrected. Additionally, consumers would have the right to opt-out of the processing of personal data for purposes of: (i) targeted advertising, (ii) sale of personal data; and (iii) certain profiling activities. The bill also requires that covered businesses obtain consumer consent before collecting sensitive personal information.
Under the bill, a “consumer” is an individual who is an Indiana resident acting in a personal, family, or household context. The bill also broadly defines “personal data” as information that is “linked or reasonably linkable to an identified or identifiable consumer.” The special category of “sensitive data” covers any personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship, immigration status, genetic or biometric data, precise geolocation data, and personal data from a known child.
The bill applies to companies that conduct business in Indiana or produce products or services targeted to Indiana residents and either: (a) control or process the personal data of 100,000 or more consumers during a calendar year; or (b) derive more than 50% of gross revenue from the sale of personal data and control or process the personal data of at least 25,000 consumers.
While several other jurisdictions, including New York, Massachusetts, and Florida, have bills which provide consumers with a private right of action, SB 358 does not provide a private right of action. Instead, the bill would be enforced through the state’s attorney general. The bill now moves to the Indiana House. If passed by the House and signed by the governor, the law will go into effect on January 1, 2025.
For further information about Indiana’s privacy bill or privacy laws in general, please contact John Landolfi, Christopher LaRocco, Nita Garg or your Vorys attorney.
