• by Wendy Davis , Yesterday

Delaware Governor Matt Meyer on Wednesday signed a privacy law that imposes new restrictions on companies' ability to disclose sensitive data about consumers.

The statute (House Bill 380), which was opposed by the ad industry, prohibits companies from selling sensitive data unless the information is "strictly necessary" for a product or service the consumer requested. Also, the law provides that companies can't sell sensitive data without first explaining the purpose of the disclosure and obtaining consumers' consent.

The measure also prohibits businesses from processing sensitive data unless doing so is "reasonably necessary and proportionate" to a purpose that's been disclosed to consumers, and consumers have consented.

The new statute defines sensitive data as including information that reveals people's race, religion, health conditions, sexual orientation, and citizenship status.

Delaware's prior privacy law, like those in several other states, only required companies to obtain consumers' consent before processing sensitive data.

Ad industry groups unsuccessfully urged Meyer to veto the bill, arguing it "would layer on rigid operational and disclosure requirements that create unnecessary complexity for residents of Delaware."

"The proposed new sensitive data consent requirements are unlikely to provide meaningful additional consumer protection beyond existing consent obligations, but they would increase implementation costs and undermine efforts to maintain consistency across state privacy laws," the Association of National Advertisers, American Association of Advertising Agencies, American Advertising Federation and Digital Advertising Alliance wrote in a June letter to Meyer.

But privacy advocates, including Consumer Reports and the Electronic Privacy Information Center, praised the new statute.

"This law should significantly reduce the amount of consumer sensitive data automatically being shared with dozens of unknown third parties,” Matt Schwartz, senior policy analyst at Consumer Reports, stated.

The new law will take effect next year.