Hoosiers would have a lot more control over the data companies keep on them under legislation unanimously approved by a Senate committee Thursday.
The bill, SB 5, would require companies to respond to consumers regarding their personal data. That includes finding out what data the companies have, correcting inaccurate information and deleting data, if requested.
Jennifer Hallowell represents Indiana tech companies. She said the bill strikes the right balance.
“It’s critical that we protect consumer data and privacy without placing overly burdensome and costly regulations on businesses,” Hallowell said.
The legislation would only apply to companies that control or process the data of at least 100,000 Hoosiers or companies that control of process the data of at least 25,000 Hoosiers and get the majority of their revenue from selling personal data.
If the companies don’t respond or comply with the bill’s requirements, the measure empowers the Indiana attorney general’s office to go after them, while not allowing individuals to sue the companies themselves.
Sen. Andrea Hunley (D-Indianapolis) voted for the bill. But she said she has reservations about leaving everything to the AG.
“As a woman and as a Black woman, people that look like me and experience life the way that I do, government hasn’t always served us well,” Hunley said.
Join the conversation and sign up for the Indiana Two-Way. Text "Indiana" to 73224. Your comments and questions in response to our weekly text help us find the answers you need on statewide issues throughout the legislative session. And follow along with our bill tracker.
No one testified against the bill in the Senate committee. But some groups, including the ACLU of Indiana, sent letters of opposition.
In addition to sharing Hunley's concern about restricting private lawsuits, ACLU Director of Advocacy and Public Policy Katie Blair said the measure doesn't go far enough in protecting consumers.
"SB 5 permits the collection, use, and sharing of personal information unless the consumer opts out, and only allows consumers to protect themselves by opting out of narrow categories," Blair said. "This framework places the burden entirely on the consumer to wade through reams of legalese with multiple service providers in order to exercise their privacy rights."
The bill wouldn’t take effect until 2026, giving companies time to comply.
A similar measure passed the Senate last year but died in the House.
Contact reporter Brandon at bsmith@ipbs.org or follow him on Twitter at @brandonjsmith5.