Enforcement of Indiana’s new data protection law begins Jan. 1

For nearly three years, corporate attorneys have been preparing Indiana companies for a new state law that provides Hoosier consumers with enhanced data protections.

The law, approved by the Indiana General Assembly in 2023, takes effect Jan. 1, a delay that was intended to give businesses plenty of time to build the processes necessary to comply with the new law and deal with consumer complaints that will be investigated by the state attorney general’s office.

The law gives Hoosiers more control over the personal data they share with large data controllers. That includes organizations that process the data of more than 100,000 Hoosiers or that earn more than 50% of their gross revenue from data sales while at the same time handling the data of at least 25,000 Hoosiers.

The aim is to offer Hoosier consumers the same protections offered in some other states, said Brian Jones, chair of Bose McKinney and Evans’ data privacy group.

“This is really a lot about data brokers and companies that are compiling consumer information for sale to other entities,” Jones said. “This really provides some way of Indiana consumers having similar rights that consumers in other states have had for a couple of years now.”

The law is aimed to be a sort of gap filler for consumers, Jones said, providing data protections not already offered through federal laws such as the Health Insurance Portability and Accountability Act of 1996, the Gramm-Leach-Bliley Act and the Children’s Online Privacy Protection Act.

Seth Wilson, an attorney with Adler Attorneys in Noblesville, agreed that the new law is an extension of existing protections. But it also gives consumers more specificity about what they can control regarding the collection and sharing of their data.

Under the new law, Hoosiers have the right to access, correct and delete their personal data, and to opt out of the sale of their data or its use in targeted advertising.

Meanwhile, data controllers must now limit the collection of personal data to only what is adequate, relevant and reasonably necessary, implement reasonable data security practices and conduct data protection impact assessments on any personal data processing activities that may pose risk of harm to their consumers.

“I think we all know all the spam calls that we get and texts and things are based on the bad actors, if you will, abusing data of consumers. And that’s a problem that I think is trying to be addressed by this,” Wilson said.

“We’ve got to make sure that consumers know they have those rights as to handling their data and how that’s done appropriately or not,” he added.

How have businesses reacted?

Wilson said most “good companies” are probably already in compliance with the new requirements, but he does expect an uptick in violation complaints to the attorney general’s office in the first year of its implementation.

“You’re going to see a potential uptick in that as more consumer awareness happens, and that will then sort of develop the framework for how they’re wanting to promote and investigate how this is gonna work,” he said.

A spokesperson for Indiana Attorney General Todd Rokita’s office said there will be an adjustment period.

“Like anything, there will be a learning and onboarding process as the law goes live,” the spokesperson said.

Jones says that a vast majority of Bose, McKinney and Evans’ clients are already in compliance with other state and federal regulations on data privacy, so he doesn’t expect a lot of legal action.

But Jones still advised that the most important thing that any business processing data can do right now is make sure it knows precisely what data is being collected and what is being done with it.

“Most of the legwork that clients have to do is really figuring out, you know, what information you have, where it’s going, what we’re doing with it, and how long we’re keeping it,” he said.

Data’s richness

In today’s world, personal data is a desired commodity.

“Data is king out there in terms of real value and what you can do with it,” Jones said.

From social media platforms like Facebook to the search engine giant Google, information like people’s names, phone numbers, email addresses and comments online are stored for various purposes.

Personal data informs services on how to tailor their ads and content for the user, while also providing information to advertisers on the performance of their ads.

“It’s like drinking from a fire hose these days, in terms of all the activity in the data space,” Jones said.

Although Jones emphasized that this law is trying to protect the individual, it is more “kind of favorable to business” because it does not give individuals a private right of action, leaving enforcement measures to the Indiana attorney general’s office.

With that in mind, the newness of the statute could limit, at least out of the gate, how much legal action takes place, Wilson said.

Wilson said he predicts businesses will see an increase in violation complaints to the attorney general’s, which could then trip out an investigation. So, he said he thinks businesses are probably going to see increased communications from the attorney general.

Under the new law, whenever the attorney general has reasonable cause to believe that a business has either violated, is violating or is about to violate the requirements, then Rokita has the power to investigate.

“Where I think the AG’s office is probably going to want to take action is for data brokers who might be gathering a whole bunch of consumer information for advertising purposes or for credit purposes,” Jones said.

Even still, he said he doesn’t see a dramatic increase in coming action.

A balance

For Wilson, the new law is a positive, given it provides tools to state officials to investigative bad actors. But he said it’s negative to know there are bad actors who need these laws to begin with.

“You’re trying to balance both sides of the scale of justice,” he added.

On the one side of the balance is operational efficiency for businesses, and on the other side is protection rights for consumers.

Ultimately, the new law gives consumers more of what they desire, the spokesperson with the attorney general’s office said.

That includes the ability to opt out of data sharing, the opportunity to delete the personal data being held by a controller and more knowledge on how their data is stored and used.•