HA1TOHB380 • 2025

This Amendment to House Bill No.

Passed Legislature

This bill passed both chambers and reached final enrollment, even if later executive action is not shown here.

Sponsor: Griffith
Last action: 2026-05-21
Official status: Stricken 5/21/26
Effective date: Not listed

Plain English Breakdown

The bill status is 'Stricken,' meaning it did not pass in this form.

Amendment Clarifying Data Sharing Rules in HB 380

This amendment defines what counts as selling personal data, lists exceptions for certain health records and credit reports, and sets rules for sharing sensitive information.

What This Bill Does

Defines 'sale of personal data' as exchanging it for money or other value with a third party.
Excludes from the definition of sale any disclosure to a third party needed to provide a product or service asked for by the consumer, unless sensitive data is exchanged for value.
Creates exceptions for health information used for treatment, payment, or operations under federal laws like HIPAA.
Requires companies to get consent before disclosing sensitive data and keep records of that consent for five years.
Excludes credit scores and similar reports from certain rules if they follow the Fair Credit Reporting Act.

Who It Names or Affects

Companies or groups called controllers that decide how personal information is used.
Third parties who receive data to help provide services asked for by consumers.
Consumers whose sensitive health, financial, or other private data is handled under these rules.

Terms To Know

Controller: A company or group that decides how personal information is collected and used.
Sale of personal data: Exchanging personal data for money or other valuable items with a third party, unless an exception applies.
Sensitive data: Private details that require extra steps like consent before being shared.

Limits and Unknowns

The amendment was removed from consideration by the House on May 21, 2026.
Because it was stricken, these changes may not become law unless added back later.
No effective date is listed for this version of the bill.

Bill History

2026-05-21 Delaware General Assembly
Stricken in House
2026-05-14 Delaware General Assembly
Introduced and Placed With Bill

Official Summary Text

This Amendment to House Bill No. 380 clarifies exceptions and requirements for the reporting and sharing of personal data under House Bill No. 380.

Current Bill Text

Read the full stored bill text

Legislation Document

SPONSOR:

Rep. Griffith

HOUSE OF REPRESENTATIVES

153rd GENERAL ASSEMBLY

HOUSE AMENDMENT NO. 1

HOUSE BILL NO. 380

AMEND House Bill No. 380 by inserting the following after line 18 and before line 19:

(29)

( )

“Sale of personal data” means the exchange of personal data for monetary or other valuable consideration by the controller to a third party. “Sale of personal data” does not include any of the following:

b. The disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the

consumer.

consumer, except that the disclosure of sensitive data for monetary or other valuable consideration by the controller to a third party must comply with § 12D-106(a)(2) of this title.

FURTHER AMEND House Bill No. 380 by inserting the following after line 59 and before line 60:

(15) Information created specifically for and collected and maintained by a manufacturer, as defined under 21 C.F.R. 820.3(o), when collected, used, or disclosed for treatment, payment, or health care operations purposes as specified under the Health Insurance Portability and Accountability Act of 1996.

(16) Information created for purposes of the Federal Health Care Quality Improvement Act of 1986 and related regulations.

(17) Information derived from protected health information regulated under the Health Insurance Portability and Accountability Act of 1996 or the Federal Policy for the Protection of Human Subjects under 45 C.F.R. Part 46, and deidentified as provided under 45 C.F.R. § 164.514.

(18) Information included in a Limited Data Set as described under 45 CFR § 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified under 45 CFR § 164.514(e).

FURTHER AMEND

House Bill No. 380 by deleting lines 153 through 154 in their entirety and inserting in lieu thereof the following:

(12) Not disclose sensitive data unless all of the following apply:

a. The dis

closure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains.

b. The controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed.

c. The controller obtains the consumer’s consent.

d. The controller maintains a record of the consumer’s consent for a period of 5 years.

e. The record of consent of Delaware consumers must be provided with any data protection assessment produced under § 12-108(c) of this title.

FURTHER AMEND

House Bill No. 380 by inserting the following after line 192 and before line 193:

(g) Nothing in subsection (f) of this section applies to a controller or third party when the report or personal data consists of a score, a model, an algorithm, or similar output that is a consumer report, or would be a consumer report if furnished to a third party, and is furnished or disclosed in compliance with the Fair Credit Report Act, 15 U.S.C. § 1681 et. seq.

SYNOPSIS

This Amendment to House Bill No. 380 clarifies exceptions and requirements for the reporting and sharing of personal data under House Bill No. 380.