Delaware\u2019s was the eighth state-level data privacy law passed in the United States in 2023 from House Bill 154<\/a>, and the twelfth comprehensive privacy law passed to date. Florida\u2019s Digital Bill of Rights<\/a> is more narrow in scope and not always included. Nevada\u2019s Privacy of Information Collected on the Internet from Consumers Act (NPICICA)<\/a> and Amendment SB-260 are also limited in scope and the original Act was passed in 2018.<\/p>\n The United States does not have a federal data privacy law, though as of July 10, 2023 it does have the new EU-U.S. Data Privacy Framework<\/a> adequacy agreement with the European Union. The EU and US had been without such an agreement since 2020 when the previous Privacy Shield was struck down.<\/p>\n Signed into law by Governor John Carney on September 11, 2023, the Delaware privacy regulation goes into effect January 1, 2025, the same date as Iowa\u2019s Consumer Data Protection Act (ICDPA)<\/a>. It also provides for an additional year for organizations to begin recognizing universal opt-out mechanisms. Delaware\u2019s Department of Justice (DOJ) plans to initiate an outreach period no later than July 1, 2024 to inform businesses of their obligations and consumers of their rights under the DPDPA.<\/p>\n Delaware\u2019s privacy law is one of the more consumer-friendly state-level data privacy laws, though not quite as strict as California\u2019s Consumer Privacy Act (CCPA)<\/a> and California Privacy Rights Act (CPRA)<\/a>. It does apply to a broader range of companies of all sizes as well, and doesn\u2019t specifically target large businesses, like Florida\u2019s law, or exclude small ones, like the Texas Data Privacy and Security Act (TDPSA)<\/a>.<\/p>\n\n\n Delaware\u2019s data privacy law protects the privacy and personal data rights of the state\u2019s one-million residents, i.e. people acting in individual or household contexts, not in any employment capacity. The law also establishes data privacy responsibilities for companies conducting business in the state and\/or providing goods and services targeted to Delaware residents.<\/p>\n Data controllers, defined under the law as \u201ca person that, alone or jointly with others, determines the purpose and means of processing personal data\u201d must provide consumers with a privacy notice that is \u201caccessible, clear, and meaningful\u201d. The notice has to describe the organization\u2019s data processing operations, and include:<\/p>\n Like all other US data privacy laws, the DPDPA uses an opt-out model, so controllers can collect personal data without needing data subjects\u2019 consent in many cases. Consumers do have the right to opt out of data collection and use, which includes sale, targeted advertising, or profiling \u201cin furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer\u201d, and must be provided with information about and mechanisms to do so.<\/p>\n The law notes that controllers must provide \u201ca clear and conspicuous link on the controller\u2019s Internet web site to an Internet web page that enables a consumer, or an agent of the consumer, to opt out of the targeted advertising or the sale of the consumer\u2019s personal data.\u201d<\/em><\/p>\n Additionally, \u201cNot later than [one year following the effective date of this Act], allowing a consumer to opt out of any processing of the consumer\u2019s personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer\u2019s consent, by a platform, technology, or mechanism to the controller indicating such consumer\u2019s intent to opt out of any such processing or sale.\u201d<\/em><\/p>\n Personal data under the DPDPA<\/strong><\/p>\n Refers to \u201cany information that is linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data or publicly available information\u201d<\/em>.<\/p>\n It should be noted that personal data (also called personal information) and personally identifiable data<\/a> are not always the same thing, and distinctions are often made in data privacy laws.<\/p>\n Sensitive data is a category that includes types of personal data that could be embarrassing or used to do harm if unlawfully accessed or misused, and thus requires special handling and under the DPDPA cannot be collected or used without prior user consent. Delaware\u2019s privacy law specifically refers to personal data that would reveal any of the following:<\/p>\n Delaware\u2019s law is the second of the US privacy laws, after Oregon\u2019s, to include transgender or nonbinary gender expression as sensitive data.<\/p>\n Like many other data privacy laws, the Delaware data privacy law follows the European Union\u2019s General Data Protection Regulation (GDPR)<\/a> with regards to the definition of valid consent: \u201ca clear affirmative act signifying a consumer\u2019s freely given, specific, informed and unambiguous agreement to allow the processing of personal data relating to the consumer.\u201d<\/em><\/p>\n To provide additional clarity, \u201cConsent\u201d may include a written statement, including by electronic means, or any other unambiguous affirmative action.\u201d<\/em> Under the DPDPA, consent does not include:<\/p>\nWhat is the Delaware data privacy act?<\/h2>\n
Privacy notice requirements<\/h4>\n
\n
Opt-out consent model<\/h4>\n
Definitions in the Delaware Personal Data Privacy Act<\/h4>\n
Sensitive data under the DPDPA<\/h4>\n
\n
Consent under the DPDPA<\/h4>\n