That Makes Twelve – Delaware Enacts New Data Privacy Legislation

On September 11, 2023, Delaware Governor John Carney signed House Bill No. 154, the “Delaware Personal Data Privacy Act,” enacting Delaware’s comprehensive consumer privacy law.  The new law is set to take effect on January 1, 2025. Delaware is the twelfth state to enact a consumer privacy law, following California, Colorado, Connecticut, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia. Four additional states, Massachusetts, New Jersey, North Carolina, and Pennsylvania, are following suit, with active bills on consumer privacy protections currently pending.

The Delaware Personal Data Privacy Act is comprehensive, imposing compliance obligations on data controllers related to the use and disclosure of personal data. For example, data controllers are required to maintain reasonable administrative, technical, and physical security practices to protect consumer data. Similar to laws enacted in other states, Delaware also grants consumers various rights, including the rights to access personal data, correct personal data, delete personal data, opt out of data processing, obtain a copy of personal data, obtain an accounting of disclosures, and to opt out of targeted advertising. The law also prohibits data controllers from discriminating against consumers who exercise their consumer rights. The Delaware Department of Justice has the authority to enforce the new law and violations could result in administrative remedies or judicial actions.

Although the Delaware Personal Data Privacy Act is similar to the other state privacy laws, businesses should become well-informed on its compliance obligations.  For further information about the Delaware Personal Data Privacy Act or privacy laws in general, please contact John Landolfi, Chris Ingram, Chris LaRocco, Gretchen Rutz Leist, Nikkia Knudsen, or your Vorys attorney.