Delaware DPDPA is Signed Into Law
Delaware Governor John Carney signed the Delaware Personal Data Privacy Act (DPDPA) into law on September 11, 2023, marking Delaware as the 13th state to implement a consumer privacy regulation.
The DPDPA closely aligns with the privacy laws of Connecticut and Virginia. The law will go into effect on January 1, 2025.
Delaware is the most recent state to pass a comprehensive privacy bill. If the bill is signed into law, Delaware will join the ranks of twelve states that have enacted consumer data privacy legislation, seven of them having passed comprehensive privacy laws since the start of 2023.
Stay updated with the latest news on the privacy scene by navigating our U.S. privacy law tracker here.
History of the Delaware Personal Data Privacy Act
The Delaware Personal Data Privacy Act, identified as HB 154 and sponsored by Rep. Krista Griffith, establishes a thorough framework of consumer protections, giving people more control over their personal data collection and increasing transparency about how that data is used.
This is the second time a Delaware online privacy and protection act was introduced in the state legislature.
Last year in May 2022, House Bill 262, sponsored by Griffith as well, proposed that data brokers be required to register with the state and provide information on how they use customer data.
Although it passed smoothly in the House with a vote of 27 to 13, it didn’t get a hearing in a Senate committee.
“We know this is a complicated bill with many provisions,” Owen Lefkon, director of the Fraud and Consumer Protection Division of the Delaware Department of Justice, said. “But at its core, it’s simple. We have to codify what consumers already expect. That their data is their own and that they should have some rights to be able to access and control it.”
Who Will the Act Impact?
The proposed Delaware privacy law will have an impact on businesses with operations in Delaware that manage the personal data of more than 35,000 consumers or more than 10,000 consumers if more than 20% of their overall revenue comes from selling personal data.
Which Rights Are Granted in the Act?
Currently, there is no practical process for the average resident to monitor or manage the collection, use, or sale of personal data. HB 154 would provide Delawareans with a number of data privacy safeguards, including:
- the right to request access to their personal data and the right to know whether a corporation is collecting and utilizing it unless doing so would reveal the company’s trade secrets.
- the right to request that any errors or inconsistencies in their personal data be fixed by a corporation.
- the right to ask that any personal information the company has amassed or gathered about them be deleted.
- the right to get a copy of the personal data the business has processed in a usable and portable format.
- the option, with some restrictions, to refuse some uses of their personal data, such as targeted advertising and data sales.
Controller Requirements
In accordance with Delaware consumer data privacy law HB 154, controllers would have to set up and maintain reasonable safeguards to protect the security and privacy of personal data. They also would have to get the consumer’s permission before processing sensitive data.
Controllers would also be obligated to give consumers a privacy notice that is easy to understand and contains information about the categories of personal data shared with third parties, the types of personal data the controller collects and uses, how consumers can exercise their rights, and the controller’s contact information.
If a controller sells personal information or uses it for targeted advertising, it must be transparent about it and let consumers know how to opt out of it. Connecticut is one of the eight states with complete data privacy legislation.
Preparation Stage
HB 154 would compel the Delaware Department of Justice to engage in public outreach to educate consumers and the business community beginning at least six months before the law’s effective date in order to make sure that they are aware of the changes to data privacy.
