Bill backed by Ohio Lt. Gov. Jon Husted would create data privacy standards for consumers

COLUMBUS, Ohio -- New legislation backed by Republican Lt. Gov. Jon Husted would create consumer privacy standards for companies that collect or sell Ohioans’ consumer data.

 The new proposed law change would create privacy rights for consumers, requiring companies to disclose how they use consumer data and, in instances where it’s sold to a third party, give consumers the right to opt out of the sale. Consumers could also ask a company to delete their data, and file a complaint with the state if they think their data is being misused.

The rules would apply only to companies with at least $25 million in gross annual revenues in Ohio, or those that use or sell large amounts of data.

 “Ohioans don’t have these rights today. Businesses don’t have these standards today,” Husted said. “We believe that that predictability, stability and transparency of the information, the more people know what’s out there, you get to have a conversation as consumers as more and more people become aware of how their data is being used,. And it’s really important that we move forward with this legislation.”

 The bill would require approval from the Ohio House of Representatives and Senate, both Republican controlled, and GOP Gov. Mike DeWine’s signature in order to become law.

Industry groups representing retailers and businesses groups also helped develop the legislation.

Given how common it is for companies to collect and use consumer data, the regulations could apply to a wide array of businesses, not just those thought of as “tech” firms. Among the industries that could be affected are insurance providers, traditional and online retailers and financial companies.

 The regulations could apply to social-media platforms, although companies like Facebook usually don’t actually sell data -- they just collect it and sell access to users to advertisers, according to Kirk Herath, a Nationwide Insurance privacy executive who helped develop the bill.

 “I’m no real fan of a lot of the social media companies, but there are some less reputable social media companies that do sell data,” Herath said. “In that case, if you opted out of that and you continue to see that things get served up to you, you have a right to complain.

The legislation wouldn’t allow individuals to sue over privacy breaches. Responsibility for enforcing violations would go to Attorney General Dave Yost, a Republican, who provided input on the bill, Husted said. If a company is the subject of a complaint, it would have 30 days to fix the problem before being subject to legal action.

The bill is sponsored by Republican state Reps. Rick Carfagna, of Delaware County and Thomas Hall, of Butler County. The proposal is an outgrowth of InnovateOhio, a department of the governor’s office that Husted oversees that aims to modernize state government and promote emerging areas of the economy. The bill has received a number, House Bill 376, although it has not yet been assigned to a committee for review.

Bill sponsors said 20 other states have passed similar regulations. Then-Gov. John Kasich, a Republican, signed the Ohio Data Protection Act in late 2018, but that law set regulations that protected private companies from lawsuits over data breaches as long as they developed a cybersecurity protocol that met state standards.