United States of America: Introduced Consumer Data Protection Bill (HB 1554) including cybersecurity regulation

On 19 January 2023, the Consumer Data Protection Bill (HB 1554) was introduced in the Indiana House of Representatives. The Bill would establish a new article in the Indiana Code concerning consumer data protection, which would apply to private, for-profit entities controlling or processing the personal data of at least 100'000 consumers, or at least 25'000 consumers in case the entity derives more than 50% of its revenue from the sale of their data (unless they are institutions of higher education). The Bill would require entities to implement data security practices protecting the confidentiality, integrity, and accessibility of consumer personal data. Such practices must be commensurate with the volume and nature of the consumer personal data. The article would be effective from 1 January 2026. HB 1554 is similar to SB 5, which was introduced in the Indiana Senate on 9 January 2023. HB 1554 does, however, contain more detailed provisions on both data brokers and the handling of children's data.