Ohio Is Considering Its First Comprehensive Privacy Law
Unlike states such as California, Virginia, and Colorado, Ohio currently does not have a single comprehensive law giving residents broad rights over their personal data. Instead, Ohio relies on a patchwork of narrower statutes covering specific situations like data breach notification and financial information. That could change. Ohio lawmakers have introduced House Bill 345, the Ohio Personal Privacy Act (OPPA), which would create a dedicated framework for how businesses collect, use, and share consumer data. As of now, the bill has not been signed into law, but it is worth understanding what it would do if enacted.
What Rights Would the OPPA Create?
If passed in its current form, the Ohio Personal Privacy Act would give consumers several new rights regarding their personal data held by covered businesses:
- The right to know what personal data a business has collected about them.
- The right to access and receive a copy of that data.
- The right to request correction of inaccurate personal data.
- The right to request deletion of personal data, subject to certain exceptions.
- The right to opt out of the sale of personal data in some circumstances.
Who Would Be Covered
The bill is generally aimed at businesses that process personal data above certain volume thresholds, rather than every small business in the state. It also includes a safe harbor provision for businesses that implement and maintain reasonable data security practices, which is intended to encourage proactive compliance rather than simply penalizing companies after a breach occurs.
Why This Matters for Ohio Consumers and Businesses
If enacted, the OPPA would represent a significant shift in how Ohioans can interact with the companies that hold their information, from healthcare providers to online retailers. For consumers, it could mean more transparency and more control. For businesses operating in Ohio, it would likely mean new compliance obligations similar to those already required in states with existing privacy laws.
What to Watch For
Legislation like this can change substantially as it moves through committee, and it is common for provisions to be added, narrowed, or removed before a final vote. Ohio residents and business owners who want to stay informed should watch for updates on the bill’s progress through the Ohio General Assembly. If the OPPA becomes law, understanding your rights, or your compliance obligations, will be important well before its effective date, since privacy laws of this kind typically include a lead-in period before enforcement begins.
How Ohio Compares to Other States
More than a dozen states have already enacted comprehensive consumer privacy laws, including California’s pioneering framework and newer laws in states like Virginia, Colorado, and Texas. These laws generally share a similar structure: consumer access and deletion rights, opt-out rights for data sales, and compliance thresholds based on the volume of data a business processes. Ohio’s proposed approach with House Bill 345 follows this general model, which means Ohio businesses that already comply with another state’s privacy law may find much of that groundwork transferable if the OPPA is ultimately signed into law.
Questions About Consumer Protection Rights?
Whether Ohio’s privacy landscape changes through the OPPA or another future bill, consumers who believe a business has misused their personal information, engaged in deceptive practices, or violated existing Ohio consumer protection laws may have legal options now. An attorney can help evaluate whether your situation involves a violation of current law.
