Bill > HB380

This bill amends Delaware's existing personal data privacy laws by lowering the threshold for businesses subject to these regulations, reducing the number of consumers whose data must be controlled or processed from 35,000 to 10,000, or from 10,000 to 5,000 if the business derives over 20% of its gross revenue from selling personal data. It also expands the definition of "sensitive data" to include inferences made from personal data that reveal specific characteristics, and clarifies that "decisions that produce legal or similarly significant effects" refer to those impacting financial services, housing, insurance, education, employment, and healthcare, among others. The bill introduces new requirements for controllers, including conducting data protection assessments for activities like targeted advertising, selling personal data, or processing sensitive data, and mandates contractual agreements with third parties that receive personal data, ensuring they provide the same level of privacy protection. Furthermore, it clarifies consumer rights, such as the right to opt out of profiling for automated decisions with significant effects, and prohibits controllers from disclosing certain sensitive personal data like Social Security numbers or financial account numbers in response to consumer access requests. The bill also introduces new duties for third parties receiving personal data, requiring them to comply with contracts and provide information for due diligence, and establishes that violations will be enforced by the Department of Justice, with the law taking effect on January 1, 2027.