USA TRENDS AND DEVELOPMENTS Contributed by: Paul Lanois, Fieldfisher
Data Protection in the USA: an Introduction As we step into 2025, the landscape of US data privacy law continues to be dominated by a patchwork of state-level privacy laws, with sev - eral states like California already having a com - prehensive consumer privacy law in place (the California Consumer Privacy Act, as amended by the California Privacy Rights Act), whereas other states are busy either implementing or enacting their own privacy legislation. By way of reminder, the first wave of US state data privacy laws came into effect in 2023 (California, Virginia, Colorado, Connecticut and Utah), with more data privacy laws coming into effect during the course of 2024 (Florida, Ore - gon, Montana and Texas). In January 2025, US state data privacy laws also entered into effect in Delaware, Iowa, Nebraska, New Hampshire and New Jersey – and more will enter into effect in the coming months:
US state law to protect “consumer health data” outside the scope of the Health Insurance Port - ability and Accountability Act (HIPAA). It came into effect on 31 March 2024 and is enforceable by the Washington Attorney General and via a private right of action. In the absence of comprehensive federal data privacy legislation, more and more state legisla - tures have been considering introducing a state data privacy law to regulate the handling of per - sonal information relating to state residents and to give state residents privacy rights (such as the right of access, the right of correction, the right of deletion and the right to opt out of targeted advertising or the sale of their personal informa - tion) that are gradually becoming standard. The following US state data privacy laws have already taken effect in 2025: • 1 January 2025: Delaware Personal Data Privacy Act; • 1 January 2025: Iowa Consumer Data Protec - tion Act; • 1 January 2025: Nebraska Data Privacy Act; • 1 January 2025: New Hampshire Privacy Act; and • 15 January 2025: New Jersey Data Privacy Act. Later this year, the following US state data pri - vacy laws are due to take effect: • 1 July 2025: Tennessee Information Protec - tion Act; • 31 July 2025: Minnesota Consumer Data Privacy Act; and • 1 October 2025: Maryland Online Data Pri - vacy Act.
• Maryland on 1 October 2025; • Minnesota on 31 July 2025; • Tennessee on 1 July 2025; • Indiana on 1 January 2026; • Kentucky on 1 January 2026; and • Rhode Island on 1 January 2026.
As usual, it is not just new US state data pri - vacy laws making the headlines, with a number of recent enforcement actions also dominating the news. This article introduces some of the key areas that are currently of note. State legislation The changes introduced by the US state data privacy laws that entered into effect in 2023 and 2024 have already been covered in previous Trends & Developments chapters, so will not be revisited here. Washington’s My Health My Data Act (MHMDA) is the first comprehensive
545 CHAMBERS.COM
Powered by FlippingBook