Delaware Enacts Personal Data Privacy Act

​Delaware Gov. John Carney recently signed a law that enacts the state's comprehensive consumer data privacy statute. Delaware joins California, Colorado, Connecticut, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia in enacting a comprehensive consumer privacy law.

Delaware's law will take effect on Jan. 1, 2025. The statute applies to people who conduct business in the state or people who produce products or services that are targeted to residents of the state and who during the prior calendar year did any of the following:

• Controlled or processed the personal data of 35,000 consumers or more, excluding personal data controlled or processed for the purpose of completing a payment transaction.
• Controlled or processed personal data of 10,000 consumers or more and derived more than 20 percent of their gross revenue from the sale of personal data.
  

Covered businesses are referred to as controllers. The statute does not apply to the following entities:

• Any regulatory, administrative, advisory, executive, legislative, or similar body of Delaware.
• Any financial institution subject to Title V of the Gamm Leach Bliley Act.
• Any nonprofit organization dedicated exclusively to preventing and addressing insurance crime.
  

The law protects consumers who are residents of Delaware, but does not cover individuals acting in a commercial or employment context or as an employee, owner, director, officer, or contractor.

The law protects personal data, which means any information that is linked or reasonably linkable to an identified or identifiable individual and does not include de-identified data or publicly available information.

The statute does not apply to certain health data, including protected health information under the Health Insurance Portability and Accountability Act (HIPAA).

Under the statute, consumers have the following rights:

To confirm whether a controller is processing the consumer's personal data.

To access personal data processed by a controller.

To correct inaccuracies in the consumer's personal data.

To delete personal data provided by or obtained about the consumer.

To obtain a copy of the consumer's personal data processed by the controller.

To obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data.

To opt out of the processing of the personal data for purposes of targeted advertising and profiling.

Obligations on Businesses

Generally, a controller must respond to a consumer exercising their rights under the statute without undue delay, but not later than 45 days after receipt of the request. The controller may extend the response by 45 additional days when reasonably necessary based on the complexity and number of requests and other factors.

Information provided to a consumer in response to a request must be provided free of charge once during any 12-month period. If the controller declines to take action in response to a consumer request, it must inform the consumer without undue delay, but not later than 45 days after receipt of the request.

Moreover, controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purpose for which the data is processed.

Controllers must establish and maintain reasonable administrative, technical, and physical data security practices to protect personal data.

Further, controllers must provide reasonably accessible, clear, and meaningful privacy notices that include the following:

• The categories of personal data processed by the controller.
• The purposes for processing the personal data.
• How consumers may exercise their rights under the statute.
• The categories of personal data that the controller shares personal data.

An active electronic mail address or the online mechanism that the consumer may use to contact the controller.

Processors of data also have enumerated obligations under the statute.

Delaware's Department of Justice has enforcement authority over the statute and may investigate and prosecute violations. There is no private right of action under the statute.

Jason Gavejian and Joseph J. Lazzarotti are attorneys with Jackson Lewis in Berkeley Heights, N.J. © 2023. All rights reserved. Reprinted with permission.