Three New States Pass Comprehensive Data Privacy Laws

Within the last two months, three new states passed comprehensive consumer data privacy laws. On May 19, 2023, the Montana Consumer Data Privacy Act was signed into law. The Texas governor signed Texas Data Privacy and Security Act into law on June 18, 2023. Also in June, the Oregon legislature passed the Oregon Consumer Privacy Act. It is currently waiting for the governor’s signature. They are the newest states to enact data privacy laws, following California, Virginia, Colorado, Utah, Connecticut, Iowa, Indiana and Tennessee. The new privacy laws generally have obligations similar to those passed by the other eight states, but there are key distinctions. Businesses in the three states should carefully evaluate each law’s applicability, disclosure obligations, specific requirements related to opt-out rights and data protection assessment requirements. 

All three provide consumers with a number of rights related to their personal data, including the right to delete it. The Texas Act has a small business exclusion, but it does include a provision prohibiting the sale of sensitive data without receiving prior consent from the consumer. The Oregon Consumer Privacy Act contains a requirement that data may not be processed without a consumer’s affirmative “opt-in” consent for “sensitive data.” Interestingly, none of the three new consumer data privacy laws provide consumers with a private right of action. The attorney general in each state holds the exclusive authority to enforce the law.