USA – MISSOURI Trends and Developments Contributed by: Mark Williams and Stefanie Brody, Sandberg, Phoenix & von Gontard, P.C.
Businesses operating in Missouri should not assume that the absence of a general biometric privacy law eliminates risk entirely. The MMPA’s broad prohibition against unfair and deceptive practices could apply to biometric data collection that is misleading or inad - equately disclosed. Healthcare Data Privacy Healthcare data privacy is an area of evolving com - plexity in Missouri. Missouri has enacted a patchwork of state statutes protecting the confidentiality of spe - cific categories of medical information. These include laws governing the confidentiality of HIV records (Sec - tion 191.656), genetic information (Section 375.1309), mental health records (Section 630.140), cancer reg - istry data (Section 192.655) and newborn hearing screening results (Section 191.928). Abortion reports submitted to the Department of Health and Senior Services are also subject to confidentiality require - ments under Section 188.070. These laws intersect with Missouri’s unsettled legal landscape for repro - ductive and gender transition services, which present significant questions about the handling and reporting of sensitive health data for businesses in the health- care sector, particularly when complying with the Attorney General’s investigations into such services. The Insurance Data Security Act – New Compliance Requirements One of the most significant recent developments in Missouri’s data privacy landscape is the Insurance Data Security Act, which took effect on 1 Janu - ary 2026. This law establishes comprehensive data security standards for insurers, insurance producers and other licensed entities operating in the state. Mis - souri’s enactment aligns the state with the National Association of Insurance Commissioners (NAIC) Insur - ance Data Security Model Law, which has now been adopted by more than 30 states. The Act imposes substantial new compliance obli - gations on covered entities, with limited exemptions for certain licensees already subject to the Health Insurance Portability and Accountability Act (HIPAA) or the Gramm-Leach-Bliley Act. At its core, the law requires each licensee to develop and maintain a written information security programme tailored to the organisation’s size, complexity, use of third-party
service providers, and the sensitivity of the non-public information it handles. The law imposes a four-busi - ness-day notification requirement for cybersecurity incidents that meet a certain threshold (such as when an event involves 250 or more Missouri consumers’ non-public information), which is notably more com - pressed than the general breach notification standard in Section 407.1500. For insurers and producers that had not previously been subject to a sector-specific data security mandate at the state level, the Act repre - sents a meaningful shift in the compliance landscape. Legislative Updates The Missouri legislature has declined to advance any recent bills proposing to enact a comprehensive con - sumer privacy act. However, the Missouri legislature is currently considering Senate Bill No 1359, which proposes a Biometric Information Privacy Act (BIPA). Unlike Illinois’ BIPA, which is consent-centric and enforced through a private right of action, Missouri’s BIPA would limit liability by creating a safe harbour for businesses using biometric identifiers, so long as those businesses meet certain compliance standards for consumer notice, retention policies and data secu - rity. The Missouri legislature is also reviewing a proposed Artificial Intelligence Transparency and Accountability Act (SB 1324), which would require labelling of AI-gen - erated content and consent for using a real person’s likeness. SB 1324 would authorise enforcement by the Attorney General and by private plaintiffs. The state house is reviewing House Bill No 3393, which would prohibit social media platforms from allowing persons under 16 years of age to create or maintain accounts separate from a parent or guardian, while minors aged 16 or 17 could hold accounts only with verified parental consent. The bill would also targets “addictive or manipulative platform design” by pro - hibiting features such as infinite-scroll mechanisms and auto-playing content without time-limit controls. The bill would also create a private right of action for parents or legal guardians of harmed minors. Conclusion Missouri’s privacy enforcement landscape is defined by the creative and aggressive application of the
600 CHAMBERS.COM
Powered by FlippingBook