Delaware Is Latest State to Enact Comprehensive Data Privacy Law

Delaware is the 13^th state to enact a comprehensive data privacy law, reports the National Law Review. The law takes effect on January 1, 2025. Delaware follows Oregon in joining California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana, Tennessee, Florida, Montana, Texas, and Florida in passing comprehensive privacy legislation. Similar to that of other states, Delaware’s law does not contain a private right of action. Enforcement power resides solely with the Delaware Department of Justice.

These are the key provisions: 

• Delaware’s privacy law will apply to consumer information only, with thresholds that are generally lower than those of other states.
• Like the privacy laws in other states, privacy notices will need to indicate what categories of data are being processed, the purpose of processing and whether data is sold or shared.
• Delaware consumers will have similar rights as they do in other states, including the right to access, correct, delete, and port personal information.
• Consumers must be given notice of, and the ability to opt out of, targeted advertising, the sale of their data, and profiling, as in other states. Consent must be obtained before processing sensitive data. In Delaware, this includes “pregnancy” as a mental or physical health condition and “transgender/non-binary status.”
• Vendor contracts for data processing will require that agreements include instruction on how to process information and the type of information that will be processed, as well as data confidentiality and the assessment of vendor compliance.

As more states enact privacy laws, differences will become harder to accommodate with a uniform policy or practice. Companies will need to be flexible about how they approach their privacy programs.