DELAWARE - Gov. Matt Meyer signed two bills Wednesday aimed at strengthening data privacy and data breach protections for Delaware consumers and businesses.
House Bill 380 lowers the threshold for Delaware’s Personal Data Privacy Act, applying the law to businesses that control or process the personal data of at least 10,000 consumers, excluding data processed solely to complete a payment transaction. According to the governor’s office, that is the lowest threshold of its kind in the country.
The law also applies to businesses that control or process the personal data of at least 5,000 consumers and derive more than 20% of their gross revenue from the sale of personal data.
House Bill 380 also expands consumers’ ability to opt out of the use of their personal data for profiling in automated decisions that produce legal or similarly significant effects. Those decisions can involve financial or lending services, housing, insurance, education, criminal justice, employment opportunities, health care or access to essential goods or services.
“Your data should belong to you, not the highest bidder, and privacy shouldn't be a privilege - it’s a right that everyone in Delaware should have,” Gov. Matt Meyer said. “That's why we're putting the broadest data protections in the country on the books, covering more Delawareans than any similar law in America and adding new safeguards for national origin, citizenship, immigration status, and gender identity. Today Delaware is holding big tech accountable.”
The legislation was developed in collaboration with Attorney General Kathy Jennings and state lawmakers.
House Bill 380 also places additional requirements on the sale of sensitive personal data. Under the law, sensitive data cannot be disclosed as part of a sale unless the disclosure is strictly necessary to provide or maintain a product or service requested by the consumer, the consumer receives clear notice and provides consent. Businesses must also maintain a record of that consent for five years.
“The digital landscape has never been as vast as it is at this moment in history. Unfortunately, that also means that the scope of threats to consumers' privacy has continued to expand,” Jennings said. “Those threats demand leadership from our policymakers and here, Representative Griffith, Senator Pinkney, and Governor Meyer have answered that call. Together, these two pieces of legislation will strengthen consumer privacy protections, prevent the misuse of Delawareans' sensitive personal data, and help my office with the readiness it needs to keep our state safe.”
House Bill 380 also narrows an existing exclusion for personal data collected in an employment context. The exclusion does not apply to certain personal data processed in connection with profiling and reports covered by the law.
Under House Bill 380, sensitive data includes information that reveals or identifies racial, national or ethnic origin; religious beliefs; mental or physical health conditions, diagnoses, treatment or status, including pregnancy; sex life; sexual orientation; transgender or nonbinary treatment or status; citizenship or immigration status; neural data; certain financial account information; and certain government-issued identification numbers.
The legislation also treats inferences drawn from other information as sensitive data when those inferences are used to reveal or identify one of the protected categories.
“Every day, we use technology that decades ago only felt like science fiction. Now it’s an essential part of our lives, used to book doctors’ appointments, apply for credit cards, find preschools in the area, and so much more. But what we don’t always think about is who has access to the information we’re putting into our devices,” said Rep. Krista Griffith, the prime sponsor of House Bills 380 and 381. “House Bills 380 and 381 help to build up the safeguards necessary to ensure that Delawareans can utilize everyday technologies without worrying that their data is being tracked and used without their knowledge.”
House Bill 381 amends Delaware’s computer security breach law to clarify when businesses must provide notice of a security breach to the Attorney General.
Both bills passed the General Assembly before being signed by Meyer.
The signing comes a week after Jennings announced Delaware is guaranteed to receive $73.6 million over 10 years as part of a $12.1 billion multistate settlement with Meta Platforms Inc.
The settlement resolves claims that Meta designed Facebook and Instagram with addictive features, knowingly exposed young users to serious mental harms and misled the public about the safety of its platforms, among other allegations. Delaware’s first-year payment also includes a one-time $4.2 million payment related to the Cambridge Analytica scandal.
The changes contained in House Bill 380 take effect Jan. 1, 2027.
