Delaware’s new consumer-data privacy law covers wider range of businesses

Delaware Gov. John Carney on Monday signed the Delaware Personal Data Privacy Act into law, making his state the 12th with a comprehensive consumer-data privacy law on the books.

The law, HB154, provides consumers the rights to know if a business possesses their personal data, correct inaccuracies in the data, request that businesses delete their data and obtain a copy of the personal data a business might have stored. Consumers can also request and obtain a list of the third parties that have received their data, and they can opt out of having their data used for targeted advertising.

Delaware’s law applies to a wider range of businesses than consumer privacy laws in other states. It applies to entities conducting business in Delaware that control or process the personal data of at least 35,000 consumers, or if they derive more than 20% of their gross revenue from the sale of personal data of just 10,000 consumers. Virginia’s consumer privacy law, by comparison, applies to companies possessing the data or 100,000 consumers or 50,000 consumers if they derive 50% of gross revenue from the sale of personal data.

Despite covering the largest range of business entities of any state-level consumer privacy law, Delaware’s law does not provide a private right of action, which would allow consumers to bring civil action for individual complaints. Instead, enforcement will be left to the state’s Department of Justice, much like Virginia leaves enforcement to its attorney general’s office.

Some privacy advocates have hailed a private right of action as being more effective at curbing noncompliance with the law and is essential for making the law enforceable, while some critics of the legal mechanism say it’s too broad. In 2021, Florida’s aggressive data privacy bill tanked due to its inclusion of a private right of action.

Delaware’s law tasks the state’s Department of Justice with issuing notices to companies found in violation. The notice gives at least 60 days to rectify the violation before the department can take action.

“Delawareans haven’t had the right to even access who has their information, how much information they have on you individually, and also, if there is something wrong with that information, to correct it. But most importantly, to even delete the information,” said state Rep. Krista Griffith, the law’s sponsor, Delaware Public Media reported.

Delaware’s law goes into effect on Jan. 1, 2025, and requires that the state’s Department of Justice engage in public outreach to educate consumers and the business community about the law at least six months prior to that date.