Bill > HB801

This bill, known as the Ohio Privacy Act, establishes rules for how state agencies in Ohio handle "private information," which is defined as any data about an individual that is not a public record. The act prohibits state agencies from collecting more private information than is necessary for their duties, and from collecting information about citizenship or immigration status unless legally required. It also restricts state agencies from disclosing private information for purposes unrelated to their programs, and any entity receiving private information must agree not to share it further, to use it only for the stated purpose, and to be liable for penalties if they misuse it; these information-sharing agreements must be publicly posted on the agency's website. State agencies can share private information as "deidentified data," meaning it's anonymized and cannot be linked back to an individual, if it benefits public services, or under specific circumstances like obtaining individual consent, a court warrant, a lawful court order, or a subpoena. If a state agency receives a request that might violate these rules, it must refer it to the Attorney General for assessment. Individuals harmed by a violation of this act can sue for damages, with specific amounts set for different types of violations, and may also recover actual damages and additional penalties for intentional violations, all to protect residents' privacy from government overreach.