Delaware’s Personal Data Privacy Act went into effect Jan. 1, bringing a new set of cyber protections to residents of the First State.
The Act, passed in 2023, requires businesses to provide transparency over their personal data practices and seek consent when they collect and use sensitive personal data.
Consumers may now opt-out of the sale of their personal information, targeted advertising and some types of automated decision making.
The bill goes as far as enabling consumers, upon request, to obtain the personal data businesses have collected about them — such as race, ethnicity, religion, health conditions, sexual orientation, gender identity, location or biometric data — and permit corrections or deletion of that data.
“I think that people sometimes are quite surprised by how much data is out there through basic activity that we all kind of take for granted as part of our normal day to day lives. And just because data can be generated or collected from our normal activity doesn't mean that we're all okay with that data being used in all kinds of different ways. We still have a sense of privacy," said the bill's sponsor and Senate Majority Leader Bryan Townsend (D-Newark).
The law applies to entities conducting business in Delaware that control or process the personal data of 35,000 consumers or more or 10,000 consumers if they derive more than 20% of their gross revenue from the sale of personal data.
There are additional protections for children as well — businesses must obtain consent to sell personal data or to use targeted advertising for children aged 13 to 17. For children under 13, businesses must obtain a parent’s consent to use a child’s personal data for any reason.
“Nowadays, your data and your privacy and your financial security can be invaded from afar. And so I think making sure that we have obligations in place that businesses are expected to take cybersecurity and data privacy very seriously is a signal we need to make sure to send to the broader world," Townsend said.
More information and resources can be found at privacy.delaware.gov.
