Hoosiers could have more control over how their personal information is stored under a proposed bill aiming to increase data privacy.
Sen. Liz Brown, R-District 15, authored Senate Bill 5, which would give Hoosiers the right to find out what personal data a company has collected from them. It would also allow citizens to obtain a copy of the data, have it corrected or deleted and opt out of having their data collected in some cases.
The bill, a top priority for the Indiana Senate GOP caucus’ 2023 session, was passed in the Senate and had its first reading in the House Feb. 28. A similar bill, Senate Bill 358, was passed by the Indiana Senate in 2022 but died before it could pass the House.
Only five U.S. states have privacy laws: California, Utah, Colorado, Connecticut and Virginia, according to the International Association of Privacy Professionals. There is no federal data privacy law.
Brown said her bill is modeled after Virginia’s bill, which she considers clear and straightforward. She said it is important for privacy bills to be easily understandable for businesses to know what they are allowed to collect and for citizens to know their rights.
The bill would apply to online and brick-and-mortar companies in Indiana that collect and process personal data of at least 100,000 people or that process the data of at least 25,000 but make more than half their revenue from that data. The bill would not apply to companies outside Indiana.
[Related: Indiana sues TikTok, alleging security and child safety violations]
Brown said she does not want small businesses under the bill’s 25,000 to 100,000 threshold to be subject to onerous regulations unless they grow to meet that threshold.
“The threshold is significant enough that we assume, and frankly haven’t heard otherwise, that these businesses are large enough that they can comply with a security data assessment and the regulations without imposing barriers to entry to business,” Brown said.
Not much would change day-to-day for consumers under the bill, Brown said, except they could request their data to be deleted or corrected if a business is large enough. They could do this through instructions in the business’ privacy notice. Individual businesses would have specific instructions on how to make those requests.
IU Vice President for Research Fred Cate, who specializes in information privacy and security law issues, said many people, himself included, are waiting for a federal data privacy law to be enacted. Privacy laws about financial, student and health information already exist on a federal level, but states are left to fill in the gaps when it comes to data privacy, he said.
While some data companies collect is useful — such as collecting a user’s IP address to send a webpage or collecting card numbers for subscriptions — collecting a large amount of data is unrelated to making technology work, Cate said.
Giving consumers total control over their data is not possible, Cate said, but privacy bills can eliminate some unnecessary practices such as excess advertising and data scraping.
[Related: IU Kelley professors study possibilities of AI technology]
Cate said putting personal information on the internet and sharing things like passwords may seem harmless but can cause issues when applying for a job or in other professional settings.
“When people ask for data, we’re just awfully quick to say yes as opposed to ‘Why do you need it?’ or “What are you going to do with it?’” he said.
While college students may be using social media and other websites to socialize, they sometimes think more about reaching the most users than privacy, he said.
IU junior and computer science major Ayman Bolad said college students often do not think about data privacy as much as they should. He said he did not pay much attention to data privacy until he saw a family member become constantly susceptible to cyberattacks while working a government job. He said he has not seen people discuss data privacy in terms of how people operate in their everyday lives.
“I think a lot of the data privacy talks on a national level recently have been in regards to TikTok and how other applications or companies use and process your data,” Bolad said. “But what’s more important to me is making sure that the information I'm giving anybody on the internet, whether it’s a person or organization now, is airtight in how it is communicated to them and how it’s used.”
Bolad said he wishes there was more transparency from companies about how they use and process data and hopes Senate Bill 5 will be a step forward.
