Delaware Passes Comprehensive Privacy Law

Delaware joined a growing list of states to pass comprehensive data privacy laws in 2023.

On June 30, the Delaware legislature passed the Personal Data Privacy Act. The bill, which awaits the governor’s signature, goes into effect Jan. 1, 2025. Other states to pass comprehensive privacy legislation include California, Colorado, Connecticut, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, Virginia and Washington.

Delaware’s bill is similar to the privacy laws passed in Colorado, Connecticut and Oregon in terms of having stronger privacy protections for consumer.

The bill contains a Gramm-Leach Bliley Act (GLBA) data and entity level exemptions, along with exemption for publicly available information. ALTA has held that any comprehensive data privacy legislation should include an exemption for entities subject to the GLBA. Since 1999, this federal law has strictly limited financial institutions’ use and sharing of customers’ personal information. Additionally, financial institutions are required to assure the security of this information and provide comprehensive disclosures to consumers. Click here to view ALTA’s principles for data privacy laws.

The act applies to entities that conduct business in Delaware that controlled or processed the personal data of more than 35,000 consumers or controlled or processed the personal data of more than 10,000 consumers if they make more than 20% of their gross revenue by selling personal data.

The bill requires Delaware Department of Justice to engage in public outreach to educate consumers and the business community about the act beginning at least six months prior to the effective date.