Delaware Joins The Data Privacy Ranks

Following Oregon in July, Delaware has become the twelfth state to enact data privacy legislation. On September 11, 2023, Governor John Carney made the Delaware Personal Data Privacy Act (“DPDPA”) official state law, with an effective date of January 1, 2025.  As has become standard among the states with data privacy laws on the books, vehicle performance data (“VPD”) is not expressly addressed but certainly is implicated. A summary of the key provisions of Delaware’s law follows, with other state summaries available here, here, here, and here.

VPD Provisions

The DPDPA does not specifically define “vehicle information” or include any provisions specific to VPD. “Personal data” is defined to mean “any information that is linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data or publicly available information.” H.B. 154, 152nd Gen. Assemb. §12D-102(21) (Del. 2023).

“Sensitive data” means personal data that, among other things, includes “precise geolocation data.” H.B. 154, 152nd Gen. Assemb. §12D-102(30)(d) (Del. 2023).  “Precise geolocation data” means “information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of 1,750 feet.” H.B. 154, 152nd Gen. Assemb. §12D-102(22) (Del. 2023).

The DPDPA restricts the collection of personal data to what is “reasonably necessary” within the purpose disclosed to the consumer, and restricts processing of such information to purposes that are “reasonably necessary,” absent consumer consent. H.B. 154, 152nd Gen. Assemb. §12D-106(a)(1), (2) (Del. 2023). Sensitive data may not be processed without consent. H.B. 154, 152nd Gen. Assemb. §12D-106(a)(4) (Del. 2023).

Consumers have the right to obtain copies of their personal data in a reasonably accessible format within 45 days of a request, except that data “controllers” are not required to disclose trade secret information. Although not expressly included, this provision should give consumers a right to request and receive VPD in a readable format. H.B. 154, 152nd Gen. Assemb. §12D-104(a)(4), (c)(1) (Del. 2023)

The DPDPA also covers “biometric data,” defined as data “generated by automatic measurements of an individual’s unique biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or characteristics can be used to identify a specific individual.” H.B. 154, 152nd Gen. Assemb. § 12D-102(3) (Del. 2023). The definition excepts, however, photographs and certain recordings and certain data derived therefrom. Biometric data is included within the definition of “sensitive data.” H.B. 154, 152nd Gen. Assemb. §12D-102(30)(b) (Del. 2023).

The DPDPA specifically exempts from its scope “personal data collected, processed, sold, or in compliance with the Driver’s Privacy Protection Act of 1994, 18 U.S.C. 2721 et seq., as amended.” H.B. 154, 152nd Gen. Assemb. §12D-103(8) (Del. 2023).

In addition, the OCPA does not prohibit a controller or processor of personal data from collecting and retaining the data for internal use to “effectuating a product recall” or “conduct internal research to develop, improve or repair products, services or technology.” H.B. 154, 152nd Gen. Assemb. §12D-110(b) (Del. 2023).

Privacy Law

Delaware Personal Data Privacy Act, effective January 1, 2025

Copyright Nelson Niehaus LLC

The opinions expressed in this blog are those of the author(s) and do not necessarily reflect the views of the Firm, its clients, or any of its or their respective affiliates. This blog post is for general information purposes and is not intended to be and should not be taken as legal advice.