Sector and government records laws by state

SB 237: An Act relating to the powers of the commissioner of administration with respect to motor vehicles; relating to electronic identification cards; relating to data sharing by the Department of Administration; relating to electronic driver's licenses and permits; and providing for an effective date.

The Department of Administration may convey, distribute, or communicate driver's license data to private entities only to carry out provisions of AS 28.15.151(g). The department shall furnish information to nonprofit organizations or governmental or tribal entities approved by the Social Security Administration to facilitate driver's license data verification upon request.

HB 1509: To create the second amendment financial privacy act; and to prohibit financial institutions from using certain discriminatory practices.

This amendment modifies HB 1509 by restructuring subsection formatting, deleting certain provisions, and increasing a monetary threshold from one thousand dollars to ten thousand dollars ($10,000).

SB 354: Insurance Information and Privacy Protection Act.

Licensees, surplus line insurers, reinsurers, and third-party service providers must collect only personal information reasonably necessary for insurance transactions, provide clear privacy notices, obtain consumer consent for non-transaction uses, retain records per written policies, and prohibit retaliation against consumers exercising privacy rights.

Takes effect 1 January 2027

SB 1114: Data collection: sexual orientation, gender identity, and intersex status: disclosure.

State entities listed in the act must collect voluntary self-identification information pertaining to sexual orientation, gender identity, and intersex status when collecting demographic data. These entities and public postsecondary education institutions must not disclose this information in a manner allowing personal identification to entities outside California state government or their vendors, except pursuant to federal program requirements or valid court orders.

Takes effect 1 January 2027

AB 1197: Rental passenger vehicles: electronic surveillance technology: renter liability for loss due to theft.

Rental companies must not use electronic surveillance technology to access information about renter vehicle use except to locate stolen or missing vehicles, respond to law enforcement requests, or use geofence technology to detect unauthorized international movement or impound yard placement. Rental companies must presume renters have no theft liability if an authorized driver returns the ignition key and files a police report within 24 hours.

HB 1196: Tenant Data Information

SB 81: Motor Vehicle Franchise Practices; protection of consumer data in motor vehicle sales; provide

Franchisors, manufacturers, distributors, and their affiliates must comply with federal and state restrictions on consumer data reuse and disclosure, provide written safeguard procedures upon request, and disclose data recipients upon written dealer request no more than twice yearly. Third parties must obtain prior express written consent before accessing protected dealer data and cannot impose data access overcharges or unreasonable integration restrictions on dealers.

SB 888: Relating to consumer protection.

An operator of a smart household security device shall not share user data with a law enforcement agency unless the user provides written consent or the agency provides a judicial warrant. An operator shall not require user consent to data sharing as a condition of device use and must clearly inform users that refusing consent will not terminate their ability to use the device.

H 149: RESIDENTIAL MORTGAGE PRACTICES – Adds to existing law to provide for consumer privacy in mortgage applications.

Solicitors of residential mortgage loans based on mortgage trigger leads must clearly and conspicuously state in initial solicitation that they are not affiliated with the consumer's original lender or broker, that personal information was purchased from a consumer reporting agency without that lender's or broker's knowledge or permission, and must comply with federal fair credit reporting act prescreening requirements. Solicitors must not knowingly or negligently use mortgage trigger lead information to solicit consumers who opted out of prescreened offers or who are on do-not-call lists.

Took effect 1 July 2025

HB 676: AN ACT relating to the Kentucky statewide health data utility.

Participants including health facilities, health care payers, and health care professionals must submit health information to the Kentucky statewide health data utility according to requirements established by the executive director, within three months after the relevant exchange becomes operational or when the person begins doing business requiring compliance.

SB 489: MOTOR VEHICLES: To authorize third party vendors to conduct a license plate inquiry on motor vehicles to verify insurance liability coverage. (8/1/26) (EN NO IMPACT See Note)

HB 293: Maryland Longitudinal Data System Center - External Data Sharing With Third-Party Data Centers for Multistate Reporting - Authorization

The Governing Board of the Maryland Longitudinal Data System Center may authorize the Center to share individual-level student and workforce data with one third-party data center at a time only for multistate research and reporting. Before sharing data, the Governing Board must ensure the third-party data center meets specified security and privacy standards and must enter into a written data sharing agreement. The Center must submit reports to specified legislative committees within 30 days and annually thereafter.

Took effect 1 July 2026

SB 198: Occupations: vehicles, dealers, and repair facilities; requirements for automobile dealer data collection; provide for. Creates new act.

Manufacturers and third parties must not access dealer data systems directly or require dealers to grant access. Third parties must not access, share, sell, copy, use, or transmit protected dealer data without prior express written consent, engage in cyber ransom, or impose fees beyond direct costs. Dealer data vendors must adopt standardized frameworks and provide open application programming interfaces to authorized integrators.

HB 1596: Money transmitters; require to implement certain data security measures and customer protections.

Money transmitters licensed under the Money Transmission Modernization Act must develop, implement, and maintain a comprehensive information security program with administrative, technical, and physical safeguards. Licensees must designate a qualified individual to oversee the program, conduct risk assessments, implement encryption for customer information, use multi-factor authentication, and notify the Commissioner of Banking and Consumer Finance within 72 hours of discovering unauthorized acquisition of unencrypted customer information.

Took effect 1 July 2026

HB 117: Establish criminal justice data warehouse priorities

Establishes priorities for the Board of Crime Control's criminal justice data warehouse projects for 2025-2026, including creating unique identifiers to link criminal justice data, acquiring software applications, and expanding data collection. Appropriates $480,000 for software, $504,243 for staffing, and $500,000 to the judiciary for data contribution.

SB 282: Limit state government use of personal electronic data

Governmental entities may not purchase electronic communications, contents of communications, geolocation data, pseudonymous data, or sensitive data except pursuant to a search warrant or investigative subpoena. Governmental entities may not obtain stored data of electronic devices without a search warrant except in specified circumstances including consent, emergency, or correctional facilities.

LB 525: Adopt the Agricultural Data Privacy Act and the Conversational Artificial Intelligence Safety Act

Controllers and processors must not sell agricultural data without express written consent from the agricultural producer. Beginning January 1, 2027, all new contracts involving agricultural data collection or processing must contain a provision prohibiting sale without consent. Controllers and processors must establish and maintain reasonable administrative, technical, and physical data security practices.

SB 40: Driver privacy and safety act

Automated license plate reader users must not sell, share, or allow access to automated license plate reader information if they reasonably believe it may be used for immigration enforcement, prosecuting legal activities including protected health care, or identifying persons based on constitutional activities. Out-of-state third parties must provide written declarations affirming compliant use. Non-law enforcement access is prohibited.

HB 1127: AN ACT to create and enact chapter 13-01.2 of the North Dakota Century Code, relating to the financial institution data security program; and to amend and reenact sections 6-01-04.1 and 6-01-04.2, subsection 7 of section 6-03-02, sections 13-04.1-01.1, 13-04.1-11.1, 13-05-07.1, 13-08-10, 13-08-11.1, and 13-09.1-14, subsection 3 of section 13-09.1-17, sections 13-09.1-38 and 13-10-05, subsection 1 of section 13-11-10, section 13-12-19, subsections 6, 21, and 22 of section 13-13-01, and sections 13-13-04 and 13-13-18 of the North Dakota Century Code, relating to the department of financial institutions, financial institutions, response to department requests, renewal of licenses, orders to cease and desist, issuance of licenses, revocation of licenses, and exemptions from licenses.

Financial corporations must develop, implement, and maintain a comprehensive information security program with written policies addressing risk assessment, access controls, encryption, multifactor authentication, incident response, and business continuity. They must designate a qualified individual to oversee the program and notify the commissioner of notification events affecting 500+ consumers within 45 days of discovery.

SB 2088: AN ACT to amend and reenact subsection 4 of section 26.1-02.2-01, sections 26.1-02.2-05 and 26.1-02.2-07, and subsection 1 of section 26.1-02.2-08 of the North Dakota Century Code, relating to data security requirements for insurance producers; and to repeal section 26.1-02.2-11 of the North Dakota Century Code, relating to implementation dates for certain data security requirements for insurance producers.

Licensees must notify the commissioner within seventy-two hours of determining a cybersecurity event involving nonpublic information has occurred, if the licensee's state of domicile or home state is North Dakota and the event has reasonable likelihood of materially harming a consumer or operations, or involves two hundred fifty or more consumers. Notification must include specified details about the event, affected consumers, and remediation efforts.

SB 2067: Financial institutions; Financial Privacy Act; permitting disclosure or release of information for investigations of financial exploitation of protected adults. Effective date.

Employees of institutions must notify their institution if they reasonably believe financial exploitation of a protected adult has occurred or is occurring. Institutions must promptly notify proper agencies and may notify trusted contacts. Institutions may place temporary holds on transactions for up to ten business days, extendable to twenty days, with notice to authorized parties within three business days.

Took effect 1 November 2026

SB 1587: Relating to data brokers; and prescribing an effective date.

A public body may not disclose personally identifiable information to a data broker unless the data broker first provides written attestation that the information will not be sold or transferred to any entity that will use it to enforce federal immigration law. A public body must reject attestations it reasonably believes contain material misrepresentations, falsehoods, or omissions.

HB 3875: Relating to personal data obtained from a consumer's use of a motor vehicle; and prescribing an effective date.

Motor vehicle manufacturers and their affiliates must comply with ORS 646A.570 to 646A.589 when controlling or processing any personal data obtained from a consumer's use of a motor vehicle or motor vehicle component, regardless of the volume of personal data processed. Other persons must comply when controlling or processing personal data of 100,000 or more consumers annually, or 25,000 or more consumers while deriving 25 percent or more annual revenue from selling personal data.

HB 1316: Driver Licenses - As enacted, prohibits the use of digital driver licenses and digital photo identification licenses for voter identification purposes; regulates the use, retention, and disclosure of data submitted by persons participating in the digital driver license system, including biometric identifiers; prohibits geolocation data from being collected for purposes of the digital driver license system; revises other provisions related to driver licenses. - Amends TCA Section 2-7-112 and Title 55, Chapter 50.

The department and entities contracting with the department must not collect geolocation data for the digital driver license system. They must destroy biometric identifiers within three calendar days and retain other data no longer than three calendar days. Digital driver licenses must not be accepted for voter identification purposes.

HB 1893: Relating to the disclosure under the public information law of a motor vehicle license plate number captured in a video recording obtained or maintained by a law enforcement agency.

A law enforcement agency may disclose a motor vehicle license plate number captured visually or audibly in a video recording without redaction in response to a public information request. The license plate number is not confidential under state law and may be included in disclosed video recordings, though law enforcement agencies may assert other exceptions to disclosure.

Took effect 1 September 2025

HB 5129: Relating to the security of certain personal identifying information submitted to or retained by a state agency.

A state agency may not disseminate personal identifying information of a person who submits information to obtain an occupational license without written consent, except when required or permitted by federal or state law or when disseminating to a law enforcement agency for law enforcement purposes. State agencies must retain written consent in their records.

HB 5061: Relating to prohibiting certain activities by contractors and vendors of state agencies; providing administrative penalties.

Contractors, subcontractors, and vendors of state agencies may not engage in surveillance targeting legislators, state employees, or complainants; engage in intimidation, coercion, or undue influence against such persons; or use private or confidential information to manipulate state contracting decisions.

Took effect 1 September 2025

HB 102: Victim Privacy Amendments

For offenses occurring on or after July 1, 2026, entities that create publicly available criminal justice documents must use a victim's initials instead of the victim's name upon request, except for criminal protective orders and motor vehicle enforcement documents. These entities must provide the victim's name in response to a court order and maintain victim information necessary to respond to lawful court orders.

Took effect 6 May 2026

HB 408: Data Sharing Amendments

Social media companies must provide users' personal data including social graphs within five business days in portable format. They must implement transparent interoperability interfaces enabling users to share selected personal data between platforms and receive real-time continuous data sharing. User consent is required before personal data is shared, including when included in another user's social graph transfer.

Takes effect 1 July 2027

HB 357: Amendments to Motor Vehicle Data Privacy

Motor vehicle manufacturers must provide in-vehicle privacy controls for model year 2030 and later vehicles allowing consumers to view collected personal data categories, view third parties receiving data, opt out of sales and targeted advertising, and delete readily accessible data. The Motor Vehicle Division must provide information on its website regarding motor vehicle owners' data privacy rights under this part.

Takes effect 1 January 2027

SB 150: Nonpublic Personal Information Amendments

Commercial entities that obtain nonpublic personal information through consumer transactions must provide notice of intent to sell that information. Commercial entities are prohibited from selling nonpublic personal information without providing required notice.

Took effect 7 May 2025

HB 418: Data Sharing Amendments

Social media companies must implement transparent, third-party-accessible interoperability interfaces allowing users to share personal data between designated services using open protocols. Social media services must provide portable personal data including social graphs upon consumer request in readily usable formats.

Took effect 1 July 2026

HB 1161: Government, Data Collection & Dissemination Practices Act; dissemin. of personal to federal gov't.

Agencies and political subdivisions must disseminate personal information only to comply with state or federal law, carry out state or federal programs, comply with subpoenas or court orders, fulfill procurement obligations, or with data subject consent. Agencies must not disseminate to federal government authorities information about religious beliefs and affiliations for compiling lists or registries based on religious affiliation, national origin, or ethnicity unless specifically required by law.

Took effect 1 July 2026

HB 1226: Motor Vehicles, Department of; release of data to certain institutions of higher education, fees.

The Commissioner of the Department of Motor Vehicles must release to accredited institutions of higher education with main campuses in Virginia the name, physical address, and contact information for holders of special license plates bearing the institution's seal or emblem, but only with the subject's written consent obtained at initial issuance, reissuance, and renewal. Institutions may use this information only for surveys, marketing, and solicitations.

SB 1193: Criminal history record information; dissemination of record information.

Criminal justice agencies must limit dissemination of criminal history record information to authorized recipients listed in the statute, including criminal justice agencies, government entities authorized by law, employers conducting background checks, and individuals requesting their own records. Noncriminal justice agencies receiving such information must limit its use to the stated purpose and may not disseminate it further.

Took effect 1 July 2025

HB 1629: Health care records; providers shall provide one free copy of records stored in EHR upon request.

Health care providers shall furnish one free copy of health records stored in electronic format to patients upon written request within 30 days. Providers may charge reasonable fees for additional copies based on format and retrieval method, except patients receive one free copy and certain requests by patients for benefits-related records incur no fees.

HB 2546: Electronic communication service or remote computing service; obtaining records without a warrant.

Providers of electronic communication service or remote computing service must disclose subscriber records only pursuant to a grand jury subpoena, search warrant, court order, or subscriber consent. Providers must disclose contents of electronic communications or real-time location data only pursuant to a search warrant, except in specified emergency circumstances listed in subsection E.

Took effect 1 July 2025

HB 1937: Acute psychiatric bed registry; patient privacy and data security, etc.

Every state facility, community services board, behavioral health authority, and private inpatient provider licensed by the Department must participate in the acute psychiatric bed registry and update bed availability information whenever there is a change or at least daily. The Commissioner must create a Bed Registry Advisory Council to review and approve all data access requests and ensure compliance with privacy laws.

Took effect 1 July 2025

SB 1439: Acute psychiatric bed registry; patient privacy and data security, etc.

Every state facility, community services board, behavioral health authority, and private inpatient provider licensed by the Department must participate in the acute psychiatric bed registry and designate employees to submit information about bed availability whenever there is a change or at least daily. The Department must develop and administer the registry and create an Advisory Council to review and approve data access requests.

Took effect 1 July 2025

SB 6002: Concerning driver privacy protections.

Agencies must not access, operate, or use automated license plate reader systems except for specific authorized purposes: law enforcement comparing data to specified databases for stolen vehicles or felony investigations, parking enforcement, and transportation agencies for traffic information. Agencies must register systems with the attorney general within 180 days, retain data no longer than 21 days with limited exceptions, and maintain audit trails.

SF 20: Data privacy-government entities.

Government entities must adopt and maintain policies for collection, access, retention, security and use of personal data consistent with federal and state law. Government entities cannot purchase, sell, trade or transfer personal data without express written consent except to other government entities, contracted nongovernment service providers, or as otherwise provided by law. Government entities cannot collect or maintain more personal data than reasonably necessary and cannot retain personal data longer than three years without written policy justifying extended retention.