Yesterday I brought you word of the pending states with consumer data privacy laws waiting on the respected Governor’s desk. Today I bring you a quick breakdown of what to expect with each state. Indiana, Montana, and Tennessee are similar to Virginia and Connecticut state laws but each state does have its nuances!
What to know about Indiana’s Consumer Data Protection Law
- Right to Know and Access
- Right to Correction
- Right to Delete
- Right to Data Portability
- Right to Opt Out of
- Targeted Advertising
- Sale of Personal Data
- Decision Profiling
- Controllers will have 45 days to respond to the consumer with a one-time extension of 45 additional days.
- Consumers requested information to be provided free once annually
- Establish a process for which a consumer can appeal a denied request
- Controllers must complete Data Protection Impact Assessments
- No private right of action
- Up to $7,500 per violation
- Offers 30-day cure period
- Effective date is January 1, 2026
What to know about Montana’s Consumer Data Privacy Act
- Right to Know and Access
- Right to Correction
- Right to Delete
- Right to Data Portability
- Right to Opt Out of
- Targeted Advertising
- Sale of Personal Data
- Decision Profiling
- Controllers will have 45 days to respond to the consumer and may extend response time by 45 additional days.
- Consumers requested information to be provided free one time within a 12-month period
- Establish a process for which a consumer can appeal a denied request
- Controllers must complete Data Protection Assessments
- No private right of action
- Offers 60-day cure period which terminates on April 1, 2026
- Effective date is October 1, 2024
What to know about Tennessee’s Information Protection Act
- Right to Know and Access
- Right to Correction
- Right to Delete
- Right to Data Portability
- Right to Opt Out of
- Targeted Advertising
- Sale of Personal Data
- Decision Profiling
- Controllers will have 45 days to respond to the consumer with a one-time extension of 45 additional days.
- Consumers requested information to be provided free twice annually
- Establish a process for which a consumer can appeal a denied request
- Controllers to conduct and document Data Protection Assessments
- No private right of action
- Up to $7,500 per violation, willing or knowingly can be awarded treble damages
- Offers 60-day cure period
- Offers Affirmative Defense via a voluntary privacy program that the controller or processor creates, maintains, and complies with a written privacy policy. See specific requirements in the bill.
- Effective date is July 1, 2024
Again these are pending bills that have passed in both the House and Senate for these states and are awaiting signature into law. I will keep my eye on these and bring you all the action as soon as possible! Stay tuned. 😊