House Judiciary rejects consumer data privacy bill after 3-3 vote

The House Judiciary Committee failed to adopt a committee substitute for a consumer data privacy bill Friday after members split 3-3 on whether to advance the measure as a working document.

The committee substitute for House Bill 367, the Alaska Data Privacy Act, would have created a data broker registry and given Alaskans new rights to control how companies collect, share, and sell their personal information. The substitute failed to be adopted after a 3-3 vote. Representatives Sarah Vance, Mia Costello, and Julie Underwood voted no. Representatives Andrew Gray, Aisha Eichide, and Donna Mena voted yes.

Rep. Andy Story, the bill's sponsor, said the legislation addresses a constitutional privacy right that is currently being violated. The bill would limit data collection to what is reasonably necessary to provide a requested service. It would require companies to let Alaskans know when their data is being collected. It would create stronger protections for youth and sensitive information.

"Personal data is collected, shared, and analyzed and sold in many ways that people never see and often do not understand what is being done with their personal data," Story said. "It is powerful, valuable, and influential."

The committee substitute fully redrafted the original bill. Story's staff member Kaylee Holm explained that the original version was modeled on California's privacy law. The substitute switched to a framework used by Virginia, Washington, Colorado, and Connecticut. The change was meant to reduce administrative burden on the state and make it easier for businesses to comply.

"We heard from businesses, we have heard from the committee," Holm said. "A lot of the questions that were asked at that very first committee hearing were considered when writing this bill."

The substitute removed a 3 percent fee on data processors that resembled a tax. It eliminated mandatory rulemaking by the Attorney General. It added a data broker registry and lowered the threshold for the number of consumers a business engages with compared to the original version. It created specific exemptions for government and tribal entities. The bill would also prohibit the sale or use of data for individuals 17 or younger and limit targeted advertising and profiling of minors.

Chair Andrew Gray's committee aide, Dylan Hitchcock Lopez, said the goal was to provide clarity and avoid conflicts with federal law. The bill exempts data already covered by comprehensive federal laws like HIPAA.

"The idea here is to provide clarity so that there is not a direct conflict of laws issue," Hitchcock Lopez said.

Costello raised concerns about giving the Attorney General broad authority to write regulations after the law takes effect. She said she was uncomfortable with the legislature handing over responsibility to the executive branch.

"We are giving a commissioner, which is the Attorney General, a tremendous amount of authority to almost rewrite law with this kind of flexibility," Costello said.

Ian Walsh from the Legislative Legal Services Division said the bill's approach is not unusual. He found about 120 other Alaska statutes that similarly authorize departments to adopt regulations to implement a law.

Gray questioned how the state would enforce the bill's requirements. He noted that many provisions depend on companies following rules that consumers cannot easily verify. Matthew Schwartz, a senior policy analyst with the Electronic Privacy Information Center, said enforcement has been limited in other states because attorneys general are often under-resourced.

"In most other states, it is left entirely up to the AG to enforce the law. There is no private right of action," Schwartz said. "The experience has been that AGs, while well-intentioned, are often under-resourced and have not been able to bring a great deal of cases to enforce the law."

Schwartz said the lack of a private right of action means enforcement depends entirely on attorney general offices that may have limited staff. He suggested that allowing private citizens to bring lawsuits could help ensure companies comply with the law.

Schwartz estimated that between 300 and 600 data brokers register in states with similar requirements, ranging from California to Vermont. He said the bill would require businesses to change behavior and collect less information upfront, especially if backed by real enforcement.

Sylvan Robb, director of the Division of Corporations, Business and Professional Licensing, said the department would need to understand the expected scope of data brokers operating in Alaska to determine staffing needs and registration fees. Holm said registration fees would be intended to cover the department's administration costs for the registry, while Department of Law costs were assumed to be covered through lawsuit settlements. The committee substitute does not yet have an updated fiscal note.

Holm said the bill addresses real harms already happening, including fraud and price discrimination. She cited an example of Instacart allegedly increasing grocery prices for customers making larger purchases.

"Knowledge is power, and it can provide a lot of influence," Holm said.

Vance said there were still too many unanswered questions. Gray removed his objection to the committee substitute, but the 3-3 vote meant the substitute failed to be adopted as a working document. Gray said the committee would bring House Bill 367 up at a later date.

The committee also advanced Senate Bill 9, which expands Alaska's safe surrender law to include infant safety devices at hospitals, fire stations, and police stations. The committee adopted an amendment requiring signage at the devices to include information about 211 or another statewide service navigation hotline and a statement about the Safe Surrender Law. The bill moved out of committee with individual recommendations.