Keypoint: The 2022 election may result in new states to watch during the 2023 state legislative session.
Until the federal government passes a preemptive federal privacy law, state legislatures will continue to be the driving force in the development of U.S. privacy law. While others have – appropriately – speculated on how the 2022 election could impact the future of federal legislation, this article analyses state election results to identify potential trends and states to watch in 2023. Although drawing conclusions across fifty states is impossible, as discussed below, a handful of states will be well-positioned to pass privacy legislation in 2023 should they choose to do so.
The M States: New Democrat Quadfectas
According to Ballotpedia, four state chambers flipped control in the 2022 election: the Michigan House and Senate, the Minnesota Senate (by one vote) and the Pennsylvania House. All four changed from Republican to Democrat controlled.
The changes in Michigan and Minnesota created Democrat trifectas with Democrat governors in control in both states. In fact, both of those states have Democrat quadfectas with Democrats retaining the state Attorney General positions in both states (see here and here). Attorney General support for a privacy bill can either significantly boost a bill’s chance of passage – as happened in Colorado and Connecticut – or create another roadblock – as has happened in Washington state.
The Minnesota and Michigan quadfectas are notable because Democrat lawmakers in those states previously proposed privacy bills. In Minnesota, Representative Steve Elkins has long been a proponent of state privacy legislation although he did not run a bill last year. In Michigan, as first reported by Future of Privacy Forum’s Keir Lamont, Democrat Senator Rosemary Bates introduced SB 1182 – the Michigan Personal Data Privacy Act – in September 2022. Democrat House members previously introduced HB 5989 in April 2022.
Massachusetts also now has a quadfecta with Maura Healey flipping the governorship to Democrat and Democrat Andrea Campbell replacing Healey as Attorney General. Last year, the Massachusetts Joint Advanced Information Technology, the Internet and Cybersecurity Committee voted a privacy bill out of committee although the bill never advanced beyond that point.
Governor-elect Healey is no stranger to privacy issues. In August 2020, then-Attorney General Healey created the Data Privacy and Security Division in the Massachusetts state Attorney General office. She also recently co-led a bipartisan group of 33 attorneys general in calling for the Federal Trade Commission to “consider the consumer harms caused by the prevalence of commercial surveillance and data security practices when creating new rules to prevent misconduct and promote transparency and accountability around online data collection.”
Finally, Maryland also now has a quadfecta with Democrat Wes Moore winning the governorship and Democrat Anthony Brown winning the race for state Attorney General. Moore will replace Republican Governor Larry Hogan who was term limited. Maryland lawmakers have pursued consumer privacy bills in the past although none have passed. Senator Susan Lee has introduced a number of bills, including last year’s SB 11. In 2022, the Maryland House passed a biometric information privacy bill (HB 259), but it never gained traction in the Maryland Senate.
It should cautioned that the existence of a trifecta or quadfecta does not by any means guarantee passage of a consumer privacy bill. Washington state has had a Democrat quadfecta for years and has still been unable to pass a bill. Conversely, Florida has been unable to pass a bill despite having a Republican quadfecta. According to Ballotpedia, as a result of the 2022 election, there will be 23 Republican trifectas, 14 Democratic trifectas and 13 divided governments.
The One Chamber States: Indiana, Iowa, and Wisconsin
Last year, the Republican-controlled Indiana Senate (SB 358), Iowa House (HF 2506), and Wisconsin Assembly (AB 957) passed more business-friendly versions of the Virginia Consumer Data Protection Act. Each of those bills failed to advance in the other chamber.
The 2023 legislative makeup in these states will look essentially the same as it did in 2022.
In Indiana, Democrats gained a seat in the House but Republicans will still have a super-majority. In the Senate, Republicans gained a seat to increase their super-majority.
In Iowa, Republicans maintained control of both chambers and flipped the Attorney General position that had been held by Democrats.
Wisconsin voters reelected Democrat Tony Evers to a second term as governor and Democrat Josh Kaul as attorney general. Conversely, Republicans maintained control of both chambers although they did not attain a super-majority.
The C States: The Potential for More Bills in California, Colorado, and Connecticut
Although we tend to focus on which state will be next to pass a consumer privacy bill, we cannot lose track of the states that already passed legislation, in particular California, Colorado, and Connecticut. In each of those states, Democrats either held onto or gained seats in the 2022 election – potentially signaling fertile ground for more data privacy legislation.
In California, Democrats will continue to hold super-majorities in the legislature and retained the governor and attorney general seats. Coming on the heels of the CCPA, last year California lawmakers passed a first-in-the-nation age-appropriate design code bill (AB 2273) and considered bills to regulate biometric information (SB 1189) and amend the state’s data broker statute (SB 1059).
Meanwhile, Colorado voters reelected Attorney General Phil Weiser, which is significant because Weiser is in the middle of Colorado Privacy Act rulemaking. Colorado voters also handed Democrats greater majorities in both the state House and Senate, and Democrat Jared Polis won reelection. Last year, Colorado lawmakers passed a law regulating the use of facial recognition technology by government agencies (SB113), and Colorado Senator Robert Rodriguez has signaled an interest in running artificial intelligence legislation.
Finally, in Connecticut, Democrats retained large majorities in both chambers of the General Assembly and Connecticut residents reelected Democrat Governor Ned Lamont and Democrat Attorney General William Tong. As required by the 2022 Connecticut Data Privacy Act, Senator James Maroney’s General Law Committee has been actively engaged in a privacy work group that is considering bills in the areas of artificial intelligence and children’s privacy, among others.
The Rest: Florida, Oregon, and Washington
For the last two legislative cycles Florida lawmakers have actively considered legislation with the Florida House passing a bill each cycle and the Florida Senate passing a bill in 2021. Over the summer, Florida Representative McFarland (who authored the House bills) indicated that she thought a change in leadership made it unlikely that Florida will pass privacy legislation for at least the next two years. That said, Republicans look to now have super-majorities in both state chambers and retained the governor and attorney general positions. If Florida Republicans want to do something on data privacy, they certainly can.
In Oregon, a work group has been actively working on drafting data privacy legislation. Democrat Tina Kotek narrowly won election to governor thereby maintaining Oregon’s Democratic quadfecta.
Finally, Washington state remains a wild card with Senator Carlyle retiring although Democrats retained controlled of the legislature.