Oklahoma Proposed New Computer Data Privacy Act

On February 7, 2022, the Oklahoma Computer Data Privacy Act of 2022 (Act) will be presented to the Oklahoma State Legislature for its first reading. This Act, if enacted, would result in several new privacy-related obligations on organizations engaging in business in Oklahoma that satisfy at least one of the following criteria:

• annual gross revenues that exceed $10 million in the preceding calendar year;
• annually buy, receive, share, or disclose for commercial purposes the personal information of 25,000 or more consumers; or
• derive 50% or more of its annual revenue from sharing consumers' personal information.

• Consumers must be notified of their right to request that a covered business delete any of the consumer’s personal information that the business retained;
• If a covered business determines that the consumer’s information is “necessary” to retain and distribute to a third party or a service provider, the businesses may reject a consumer’s request to delete their personal information. Upon rejection, the covered business must provide the consumer with the reason the information was deemed “necessary” and disclose to the consumer the parties to whom information was distributed.
• A business who determines retention of a consumer’s personal information is necessary will be required to notify consumers of their right to opt out of personalized advertisements.
• Covered businesses must have two “easily accessible” and “readily identifiable” points of contact for use by consumers.
• Covered businesses must not “design, modify, or manipulate” a user interface to, in any way, interfere with a consumer’s rights and options under the Act.
• Covered businesses must “implement and maintain reasonable security procedures and practices” and enforce these same requirements of compliance on third party service providers in order to protect a consumer’s rights under this Act.

If enacted, the Act will be enforceable by the Attorney General via penalties ranging from $2,500 to $7,500 per violation.

This Oklahoma privacy legislation is one of many new proposed state laws in 2022, demonstrating a clear trend toward this type of obligation on businesses.