Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

On July 12, Ohio legislators formally introduced the <a href="https://search-prod.lis.state.oh.us/solarapi/v1/general_assembly_134/bills/hb376/IN/00/hb376_00_IN?format=pdf" target="_self" rel="noopener">Ohio Personal Privacy Act</a> (HB 376) and with it, Ohio has joined the growing number of states that are actively seeking to implement a consumer data protection law. Although HB 376 affords Ohio consumers with rights and privileges with respect to their personal data, the bill is more limited in scope than other state data protection laws that recently have been enacted (e.g., <a href="https://www.thompsonhine.com/publications/california-voters-approve-new-data-privacy-law" target="_self" rel="noopener">California</a>, <a href="https://admin.thompsonhine.com/wp-content/uploads/1139/doc/Privacy_&amp;_Cybersecurity_Update_-_Colorado_Enacts_New_Data_Privacy_Law.pdf" target="_self" rel="noopener">Colorado</a>, <a href="https://www.thompsonhine.com/publications/virginia-lawmakers-approve-new-data-privacy-and-cybersecurity-law" target="_self" rel="noopener">Virginia</a>). Notably, the bill does not contain a private right of action; however, it does furnish the Ohio Attorney General with broad authority to penalize non-compliant businesses, which may include civil penalties, attorneys’ fees, and investigatory costs.

contentpilot/introduction

HB 376 likely will be sent to legislative subcommittees with jurisdiction over consumer protection and technology where it will be debated and amended. The bill has been strongly endorsed by Ohio’s Lt. Governor Jon Husted and other senior Ohio politicians, which may increase the likelihood that it will be enacted into law.

core/paragraph

core/heading

As currently written, HB 376 only applies to certain types of organizations that conduct business in Ohio or produce goods or services that target Ohio consumers. For instance, the bill only applies to such businesses that also have generated $25 million in annual gross revenue in Ohio or collect and process large volumes of personal data or generate a certain percentage of its revenue from the sale of personal data. The law creates many exceptions, including for businesses subject to federal privacy laws (e.g., healthcare organizations, financial institutions), for employee and “HR” data, and to individuals acting in a business capacity (i.e., “business-to-business” data).

HB 376 creates new data privacy rights and privileges for Ohio consumers:

• the right to request access to and the disclosure of their personal data that a business collects about them; • the right to request that a business delete personal data that the business has collected from them and maintains in an electronic format; and • the right to request that a business refrain from selling their personal data to third parties.

Notably, the Ohio bill does not specifically address targeted advertising in a manner comparable to other recently enacted state privacy laws (e.g., “do not share” requirements). HB 376 creates a framework for how businesses must receive, authenticate and respond to consumer privacy requests.

The bill expressly prohibits businesses from discriminating against a consumer for exercising their data privacy rights. However, none of the data subject privacy rights are absolute and HB 376 creates exceptions and exemptions with respect to how consumers can exercise their rights and how businesses must respond to the same. Further, HB 376 provides that businesses may charge different prices or rates for goods or services for individuals who exercise their privacy rights, provided they have “legitimate business reasons” or, as otherwise permitted or required by applicable law, to do so. This will allow businesses to continue to engage in customer loyalty and similar marketing programs.

HB 376 provides Ohio consumers with the “right to know” the types of personal data a business collects about them and how it is used and disclosed. More specifically, businesses are required to provide consumers with a privacy policy setting forth, among other issues:

• the categories of personal data the business processes and the purposes of such processing; • the categories of sources from which the personal data is collected; • the categories of processors (e.g., service providers) with whom the business discloses personal data; • whether the business sells personal data, and if so, the categories of third parties to whom the business sells personal data, and the purposes of the sale; • a description of the business's data retention practices; • how individuals can exercise their privacy rights; and • a description of the business's data security measures.

HB 376 requires businesses to adopt certain measures with respect to providing notice to, and obtaining consent from, Ohio consumers in the event their data privacy practices change or are amended after they furnish their privacy policies to consumers. Failing to maintain a privacy policy that reflects a business's data privacy practices to a reasonable degree of accuracy is considered an “unfair and deceptive practice” under Ohio law.

As currently written, HB 376 requires businesses to enter into written contracts or agreements with third party service providers that process personal data on their behalf (i.e., “processors”). More specifically, a business is required to “enter into a written contract with a processor that prohibits the processor from processing personal data except to provide services to the business.” Notwithstanding the generality of this prohibition, businesses may allow processors to (i) retain their own subcontractors (i.e., subprocessors), provided they comply with the same obligations as the processor, (ii) use personal data for internal purposes to improve the quality of its products or services, and (iii) use personal data provided by the business to detect or prevent data security incidents, fraud, or illegal activity. Under HB 376, a business is not liable in the event its processor uses personal data in violation of the law, provided that the business did not have actual knowledge, or reason to believe, that the processor would commit such a violation. On the other hand, a processor is not be liable for violations of HB 376 for the obligations of a business for which the processor provides services.

Pursuant to HB 376, a business has an affirmative defense against allegations of non-compliance if that business creates, maintains, and complies with a written privacy program that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework entitled<a href="https://www.nist.gov/system/files/documents/2020/01/16/NIST Privacy Framework_V1.0.pdf" target="_self" rel="noopener"> "A Tool for Improving Privacy through Enterprise Risk Management Version 1.0,"</a> including applicable controls selected by the business from NIST Special Publication 800-53 and 800-53a. In order to leverage this affirmative defense, an organization’s privacy program must be based on its size and complexity, the nature and scope of its business activities, the sensitivity of the personal data it processes, the cost and availability of tools to improve privacy protections and data governance, and compliance with any comparable state or federal law. Interestingly, HB 376 adheres to a similar framework set forth in Ohio’s <a href="https://admin.thompsonhine.com/wp-content/uploads/1137/doc/Steven_G._Stransky_and_Thomas_F._Zych.pdf" target="_self" rel="noopener">cybersecurity safe harbor law</a>&nbsp;(S.B. 220), which grants Ohio businesses certain affirmative defenses from data breach-related claims to the extent it complies with certain cybersecurity standard and measures.

Steven G. Stransky 216.566.5646 202.263.4126 <a href="mailto:Steve.Stransky@ThompsonHine.com">Steve.Stransky@ThompsonHine.com</a> Certified Information Privacy Professional/Government (CIPP/G) Certified Information Privacy Professional/United States (CIPP/US)

Thomas F. Zych 216.566.5605 <a href="mailto:Tom.Zych@ThompsonHine.com">Tom.Zych@ThompsonHine.com</a>

or any member of our <a href="https://www.thompsonhine.com/services/privacy-and-cybersecurity" target="_self" rel="noopener">Privacy &amp; Cybersecurity</a>&nbsp;group.

This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel. This document may be considered attorney advertising in some jurisdictions.

Ohio Introduces Consumer Data Privacy Bill

Services