Update applicable to:
All employers in Delaware who meet the applicability factors
What happened?
The Delaware legislature passed the Delaware Personal Data Privacy Act (HB 154) on June 30, 2023, making Delaware the twelfth state and the seventh this year to enact a consumer data privacy law.
What are the details?
Applicability:
The Delaware bill follows the applicability standard of the Washington Privacy Act variants, based on the number of consumers whose data the entity collects. However, Delaware lowers the threshold to 35,000 consumers to account for its lower population. It also adjusts the second applicability threshold based on the number of consumers and the percentage of gross revenue derived from the sale of personal data.
Nonprofits:
Unlike the CTDPA, the Delaware bill does not exempt nonprofits, except for those dedicated to preventing and addressing insurance crime or providing services to victims of certain crimes.
Notable Exemptions:
The Delaware bill exempts state governmental entities but excludes institutions of higher education. It does not provide an entity-level exemption for HIPAA covered entities and business associates but contains data-level exemptions for health data. The bill also offers exemptions for GLBA financial institutions and data subject to the GLBA.
Consumer Rights:
Delaware includes rights similar to Connecticut’s, such as recognizing universal opt-out mechanisms. It adds the right for consumers to obtain a list of the categories of third parties to which their personal data has been disclosed.
Children’s Privacy Rights:
Delaware raises the age limit for processing personal data for targeted advertising or selling personal data without consent from under 16 to under 18, aligning with Connecticut’s Senate Bill 3.
Sensitive Data:
Delaware includes “status as transgender or nonbinary” in its definition of sensitive data, similar to the Oregon bill. It also defines genetic data, which is not present in other laws.
Profiling:
Delaware adds “demographic characteristics” to the list of topics covered by profiling.
Data Protection Assessments:
The requirements for data protection assessments are similar to Connecticut’s, with the exception that Delaware specifies their application to processing activities created or generated six months after the law’s effective date.
Enforcement:
The Delaware Attorney General’s Office will enforce the bill, which does not provide a private right of action. It includes a sixty-day right to cure that expires on December 31, 2025.
Effective Date:
The bill is set to go into effect on January 1, 2025, subject to being enacted before January 1, 2024.
For more information, please see the links below:
What do employers need to do?
Employers should review the requirements of the bill. Additionally, it is worth noting that Delaware already has an existing online privacy law – the Delaware Online Privacy and Protection Act (DelOPPA). Although the requirements in DelOPPA are far less stringent than this new bill, entities should consider both laws when driving compliance.
Need help understanding how changes to employment laws will affect your business?
Learn more about how Vensure's Delaware PEO services can help you navigate complex employment laws and keep your business compliant.
This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.
