Indiana Senators Approves Consumer Privacy Bill

On January 27, 2022, the Indiana Senate Committee on Commerce and Technology unanimously passed  SB 358, which outlines consumer personal data protection in the state. The bill is currently being reviewed by the Committee on Commerce, Small Business and Economic Development.

Covered businesses under the bill are businesses that collect Indiana residents ("consumers") information and either:

a)       control or process any information that can be used to link, or reasonably link, to the identity of the consumer ("personal data") of 100,000 or more consumers during a calendar year; or

b)      derive more than 50% of gross revenue from the sale of personal data and control or process the personal data of at least 25,000 consumers

Under the bill, a consumer would have the right to

a)       request that a business disclose, delete, or amend the consumer's personal data maintained by such business, and

b)      “opt-out” of a business's processing of the consumer's personal data for the purpose of targeted advertising, the sale of personal data, and activities relating to profiling. 

Covered businesses would be required to obtain consumers' consent before collecting any personal data that could be categorized as “sensitive.” Information is considered “sensitive” if it identifies a consumer’s “racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship, immigration status, genetic or biometric data, precise geolocation data, and personal data from a known child.”

The requirements of this bill are similar to those outlined in HB 381, amending the state’s consumer data protection governance in a manner that many other states have proposed or adopted.