Ohio Personal Privacy Act (Senate Bill 376)

Proposed privacy framework incorporating unique safe harbor provisions. Would apply to businesses meeting specific thresholds for data processing or revenue. Establishes consumer rights for access, deletion, correction, and portability of personal data. Includes safe harbor protection for businesses that maintain reasonable security measures and implement specified privacy programs. Enforcement exclusively through attorney general with no private right of action. Includes specific exemptions for certain types of data and entities.

JurisdictionOhio
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

The Ohio Personal Privacy Act (OPPA) establishes several key requirements for businesses:

  • Applicability thresholds: The OPPA applies to businesses that conduct business in Ohio or target Ohio consumers and meet one of the following criteria:
  • Annual gross revenues generated in Ohio exceed $25 million
  • Control or process personal data of 100,000 or more Ohio consumers during a calendar year
  • Derive over 50% of gross revenue from the sale of personal data and process personal data of 25,000 or more Ohio consumers

Source: [Ohio Legislature HB 376 Text]

  • Consumer rights: The OPPA grants Ohio consumers the following rights:
  • Right to know what personal data is collected
  • Right to access their personal data
  • Right to delete personal data
  • Right to opt-out of the sale of personal data

Source: [Ohio Attorney General OPPA Overview]

  • Privacy notice requirements: Businesses must provide a clear and accessible privacy policy detailing:
  • Categories of personal data collected
  • Purposes for processing personal data
  • Consumer rights and how to exercise them
  • Data retention practices
  • Data security practices

Source: [Hinshaw Law OPPA Analysis]

  • Safe harbor provision: Businesses can claim an affirmative defense against alleged violations if they implement a written privacy program that conforms to the NIST Privacy Framework

Source: [Thompson Hine OPPA Overview]

Compliance Challenges

Organizations face several challenges in complying with the OPPA:

  • Data mapping and inventory: Companies struggle to identify and categorize all personal data they collect and process across systems

Source: [IAPP Privacy Implementation Challenges]

  • Implementing consumer rights processes: Establishing efficient systems to handle consumer requests for access, deletion, and opt-outs can be complex

Source: [Deloitte Privacy Compliance Challenges]

  • Updating privacy notices: Crafting clear, comprehensive privacy policies that meet all OPPA requirements while remaining understandable to consumers

Source: [IAPP Privacy Notice Challenges]

  • Ensuring proper consent management: Implementing systems to obtain and manage consumer consent for data collection and processing

Source: [OneTrust Consent Management Challenges]

Implementation Best Practices

To effectively implement OPPA requirements, organizations should:

  • Conduct a data inventory: Thoroughly map all personal data collected, processed, and shared

Source: [IAPP Data Inventory Guide]

  • Implement a privacy management platform: Utilize software to streamline consumer rights requests and consent management

Source: [OneTrust Privacy Management Platform]

  • Develop a comprehensive privacy program: Create policies and procedures aligned with the NIST Privacy Framework

Source: [NIST Privacy Framework]

  • Conduct regular privacy impact assessments: Evaluate privacy risks and mitigation measures on an ongoing basis

Source: [IAPP Privacy Impact Assessment Guide]

  • Provide employee training: Ensure all staff understand OPPA requirements and privacy best practices

Source: [IAPP Privacy Training Resources]

Recent Updates

As of June 2024, the Ohio Personal Privacy Act (HB 376) has not been enacted into law. Key updates include:

  • The bill was introduced in the Ohio House of Representatives on July 13, 2021

Source: [Ohio Legislature HB 376 Status]

  • The bill remains under consideration in committee as of the latest legislative session

Source: [Ohio Legislature Committee Hearings]

  • No specific compliance deadline has been set, as the bill has not yet passed

Organizations should monitor the Ohio Legislature website for future updates on the bill's status and potential enactment.

Related Regulations

The OPPA shares similarities with other state and federal privacy regulations:

  • California Consumer Privacy Act (CCPA): Similar consumer rights and business obligations, but CCPA has broader applicability

Source: [California Attorney General CCPA Page]

  • Virginia Consumer Data Protection Act (VCDPA): Comparable scope and consumer rights, with some differences in enforcement

Source: [Virginia Legislative Information System VCDPA Text]

  • General Data Protection Regulation (GDPR): EU regulation with stricter requirements but similar principles of data protection and consumer rights

Source: [EU GDPR Portal]

  • Gramm-Leach-Bliley Act (GLBA): Federal law governing financial institutions' data practices, which would take precedence over OPPA for covered entities

Source: [FTC GLBA Page]

Industry Impact

The OPPA would have varying impacts across industries:

  • Technology and E-commerce: Likely to face significant compliance burdens due to large volumes of consumer data processed

Source: [CompTIA Tech Industry Outlook]

  • Healthcare: Largely exempt due to HIPAA preemption, but may face challenges with non-HIPAA covered data

Source: [HIMSS Privacy in Healthcare]

  • Financial Services: Partially exempt due to GLBA, but may need to comply for non-financial consumer data

Source: [American Bankers Association Privacy Page]

  • Small Businesses: Those meeting thresholds may struggle with compliance costs and technical requirements

Source: [NFIB Small Business Data Privacy Concerns]

Sources

Recent developments

  • — OneTrust DataGuidance publishes an updated Ohio profile noting that House Bill 345 to enact the Ohio Personal Privacy Act was introduced on 2023-11-29 and referred to the Government Oversight Committee on 2023-12-06, but has not yet been enacted, leaving Ohio without a comprehensive privacy law and relying instead on case law and sectoral statutes.[4] (source)
  • — Privacy practitioners highlight that OPPA/House Bill 345 remains pending in committee with no advancement since referral, underscoring continued regulatory uncertainty for businesses processing Ohio consumer data and the importance of complying with existing breach-notification and sector-specific rules.[4] (source)
  • — Legislative tracking services reiterate the core features of the proposed Ohio Personal Privacy Act (HB 376/HB 345), including applicability thresholds ($25M revenue or specified data-volume criteria), consumer rights to access, correct, delete, and opt out of sale/targeted advertising, non-discrimination obligations, and exclusive enforcement by the Attorney General with penalties up to $5,000 per violation.[5] (source)
  • — An updated legislative analysis of HB 376 is circulated among compliance professionals, summarizing controller/processor duties around collection, processing, and sale of digital personal data, defining “personal data,” and detailing the Attorney General’s enforcement powers and the one‑year delayed effective date if the bill is enacted.[6] (source)
  • — Legal commentaries on Ohio’s privacy landscape emphasize that, pending OPPA’s enactment, organizations must focus on Ohio’s data breach notification regime (ORC §1349.19) and existing health, financial, and employment data rules, while monitoring OPPA’s progress as part of the broader trend of state consumer-privacy laws.[4] (source)
  • — Industry analyses compare OPPA to other state privacy laws, noting its controller/processor paradigm, consumer opt‑out rights for data sale, broad business exemptions, and the absence of a private right of action, which collectively make the bill relatively business‑friendly while still imposing significant compliance obligations.[4] (source)
  • — Compliance blogs referencing HB 376/OPPA stress the potential operational impacts on companies with large datasets of Ohio consumers, including the need for robust privacy notices, mechanisms to handle consumer requests, and governance processes aligned with the bill’s definitions and thresholds in anticipation of possible movement in the 2025–2026 session.[5] (source)
  • — Risk and compliance advisors draw attention to OPPA’s proposed affirmative defense based on maintaining a written privacy program that conforms to national standards (such as NIST), encouraging businesses to proactively adopt such frameworks to mitigate enforcement risk should the Act pass.[6] (source)
  • — Data protection newsletters report that, despite renewed introduction as HB 345 in late 2023, OPPA has not advanced, prompting organizations to treat it as a “watch list” item rather than an active compliance obligation but to plan for potential future consumer rights and AG‑led enforcement.[4] (source)
  • — Sector-wide reaction pieces note that many Ohio‑focused businesses are informally benchmarking against OPPA’s proposed requirements (e.g., opt‑out mechanisms, privacy notices, and data‑subject request workflows) to stay ahead of possible enactment and align with emerging national privacy norms.[4] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates