Consumer Data Privacy Laws
Excerpts from key consumer privacy laws where public data is exempted:
CALIFORNIA CONSUMER PRIVACY ACT
“Personal information does not include publicly available information. For purposes of this paragraph, ‘publicly available’ means information that is lawfully made available from federal, state, or local government records.”
THE CALIFORNIA PRIVACY RIGHTS ACT OF 2020*
“For purposes of this paragraph, ‘publicly available’ means: Information that is lawfully made available from federal, state, or local government records, or if any such information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or by the consumer; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the Information to a specific audience.”
(*Takes effect January 1, 2023)
THE COLORADO PRIVACY ACT
“Personal data" does not include de-identified data or publicly available information. As used in this subsection (17)(b), "publicly available information" means information that is lawfully made available from federal, state, or local government records and information that a controller has a reasonable basis to believe the consumer has lawfully made available to the general public.”
THE CONNECTICUT DATA PRIVACY ACT
"Publicly available information" means information that (A) is lawfully made available through federal, state or municipal government records or widely distributed media, and (B) a controller has a reasonable basis to believe a consumer has lawfully made available to the general public.”
FLORIDA SECURITY BREACH NOTIFICATION LAW
“Personal Information does not include information about an individual that has been made publicly available by a federal, state, or local governmental entity.”
ILLINOIS PERSONAL INFORMATION PROTECTION ACT
"Personal information does not include publicly available information that is lawfully made available to the general public from federal, State, or local government records.”
MASSACHUSETTS SECURITY BREACH NOTIFICATION LAW
“Personal information shall not include information that is lawfully obtained from publicly available information, or from federal, state or local government records lawfully made available to the general public.”
MICHIGAN IDENTITY THEFT PROTECTION ACT
“This section does not apply to the access or acquisition by a person or agency of federal, state, or local government records or documents lawfully made available to the general public.”
MINNESOTA DATA WAREHOUSE NOTICE REQUIRED FOR CERTAIN DISCLOSURES
“For purposes of this section and section 13.055, subdivision 6, ‘personal information’ does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.”
NEVADA SECURITY BREACH NOTIFICATION LAW
“Personal Information Defined: The term does not include the last four digits of a social security number, the last four digits of a driver’s license number, the last four digits of a driver authorization card number or the last four digits of an identification card number or publicly available information that is lawfully made available to the general public from federal, state or local governmental records.”
NEW YORK STATE INFORMATION SECURITY BREACH AND NOTIFICATION ACT
“Private information does not include publicly available information which is lawfully made available to the general public from federal, state, or local government records.”
NORTH CAROLINA DISCLOSURE OF SECURITY BREACH LAW
“Personal information does not include publicly available directories containing information an individual has voluntarily consented to have publicly disseminated or listed, including name, address, and telephone number, and does not include information made lawfully available to the general public from federal, state, or local government records.”
OHIO AGENCY DISCLOSURE OF SECURITY BREACH LAW
“Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records…”
TEXAS IDENTITY THEFT ENFORCEMENT AND PROTECTION ACT
“For purposes of this chapter, the term ‘sensitive personal information’ does not include publicly available information that is lawfully made available to the public from the federal government or a state or local government.”
WASHINGTON STATE SECURITY BREACH NOTIFICATION LAW
“Personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.”
