Oklahoma City, OK— Majority Leader Rep. Josh West and Rep. Collin Walke filed for introduction HB 2969, the Oklahoma Computer Data Privacy Act of 2022 (OCDPA) to advance privacy protections for all Oklahoman residents. This legislation is based in part on CR’s model bill and takes a strong data minimization approach to controlling companies’ data practices and protects consumers’ privacy by default.
This approach is important, because emerging state privacy laws like the California Consumer Privacy Act (CCPA) are often based on an opt-out model, which can make it difficult for consumers to control the disclosure of their personal information. Consumers may have to reach out to hundreds, if not thousands, of companies to fully protect their privacy. Further, CR research found that it can be difficult for consumers to stop the sale of their information by data brokers. Importantly, the OCDPA also includes “non-discrimination” language to ensure that companies cannot charge consumers for declining to share information with other companies—so that everyone can exercise their privacy rights.
“We applaud Majority Leader West and Rep. Walke for introducing legislation that puts consumer privacy first,” said Maureen Mahoney, senior policy analyst at Consumer Reports. “For too long, companies like Google and Facebook have been allowed to freely collect consumer data, without meaningful restrictions. This legislation helps correct the power imbalance and give consumers real control over their personal information.”
The OCDPA puts important limits on the amount of data that companies can collect in the first place. While newly-passed laws in California, Colorado, and Virginia place next to no controls over the amount of data that companies can collect, this bill requires companies to tailor the collection of their data to what is reasonably needed to deliver the requested product or service. This will help protect against inappropriate use of the data and reduce the security threat posed by retaining unnecessary information.
The OCDPA also provides appropriate incentives for companies to comply, by ensuring that companies can be held liable for first-time violations, if the Attorney General deems appropriate. This helps level the playing field between under-resourced enforcement agencies and well-funded tech companies. Many other state bills include so-called “right to cure” provisions that tie the hands of the Attorney General and could force them to waste resources building cases that go nowhere.
Since the California Consumer Privacy Act was passed in 2018, over a dozen states have considered state privacy legislation, and earlier this year, Virginia and Colorado have adopted these laws. Ohio and Pennsylvania still have active bills this year.
Contact: Cyrus Rassool, cyrus.rassool@consumer.org