HA2TOHB380 • 2025

This Amendment contains the same changes to House Bill No.

Healthcare Labor

Passed Legislature

This bill passed both chambers and reached final enrollment, even if later executive action is not shown here.

Sponsor: Griffith
Last action: 2026-05-21
Official status: Passed 5/21/26
Effective date: Not listed

Plain English Breakdown

The official text defines the scope of exemptions for health information but does not detail how these interact with other parts of House Bill No. 380 outside this amendment.

Amendment Changing Rules on Selling Sensitive Data

This amendment updates House Bill No. 380 to limit exceptions for sharing sensitive data only when personal data is sold and clarifies that the law does not apply to banks, credit unions, or savings associations principally engaged in financial activities.

What This Bill Does

Changes rules so that exceptions for disclosing sensitive data apply only when the disclosure happens during a sale of personal data.
Defines 'sale of personal data' as exchanging personal data for money or other valuable consideration by a controller to a third party, excluding disclosures made just to provide a product or service requested by the consumer unless it involves selling sensitive data.
Requires controllers to get consumer consent and keep records for five years before disclosing sensitive data in a sale of personal data.
Clarifies that the law does not apply to federal or state chartered banks, credit unions, savings associations, or their affiliates principally engaged in financial activities.
Adds exceptions for specific health information regulated by laws like HIPAA and the Federal Health Care Quality Improvement Act.

Who It Names or Affects

Companies that sell personal data
Federal and state chartered banks
Credit unions and savings associations principally engaged in financial activities
Manufacturers handling specific types of medical or research data

Terms To Know

Sale of personal data: Exchanging a person's information for money or something else of value.
Controller: The company or group that decides how and why personal data is used.
Sensitive data: Personal information that needs extra protection under this law when sold.

Limits and Unknowns

The text does not state an effective date for these new rules.
The amendment refers to other sections of House Bill No. 380 without listing all their details here.
It is unclear how this change affects companies that share data for free but receive non-monetary value, as the definition focuses on 'valuable consideration'.

Bill History

2026-05-21 Delaware General Assembly
Introduced and Placed With Bill
2026-05-21 Delaware General Assembly
Passed In House by Voice Vote

Official Summary Text

This Amendment contains the same changes to House Bill No. 380 as Amendment 1 to House Bill No. 380, with the exception that it changes exceptions to the disclosure of sensitive data to apply only to the disclosure of sensitive data in a sale of personal data, and clarifies that the chapter does not apply to federal or state chartered banks, credit unions, savings associations, or affiliates or subsidiaries thereof that are principally engaged in financial activities.

Current Bill Text

Read the full stored bill text

Legislation Document

SPONSOR:

Rep. Griffith

HOUSE OF REPRESENTATIVES

153rd GENERAL ASSEMBLY

HOUSE AMENDMENT NO. 2

HOUSE BILL NO. 380

AMEND House Bill No. 380 by inserting the following after line 18 and before line 19:

(29)

( )

“Sale of personal data” means the exchange of personal data for monetary or other valuable consideration by the controller to a third party. “Sale of personal data” does not include any of the following:

b. The disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the

consumer.

consumer, except that the disclosure of sensitive data for monetary or other valuable consideration by the controller to a third party must comply with § 12D-106(a)(2) of this title.

FURTHER AMEND House Bill No. 380 on line 51 by deleting “

directly

” as it appears therein and inserting in lieu thereof “

principally

”.

FURTHER AMEND House Bill No. 380 by inserting the following after line 59 and before line 60:

(15) Information created specifically for and collected and maintained by a manufacturer, as defined under 21 C.F.R. 820.3(o), when collected, used, or disclosed for treatment, payment, or health care operations purposes as specified under the Health Insurance Portability and Accountability Act of 1996.

(16) Information created for purposes of the Federal Health Care Quality Improvement Act of 1986 and related regulations.

(17) Information derived from protected health information regulated under the Health Insurance Portability and Accountability Act of 1996 or the Federal Policy for the Protection of Human Subjects under 45 C.F.R. Part 46, and deidentified as provided under 45 C.F.R. § 164.514.

(18) Information included in a Limited Data Set as described under 45 CFR § 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified under 45 CFR § 164.514(e).

FURTHER AMEND

House Bill No. 380 by deleting lines 153 through 154 in their entirety and inserting in lieu thereof the following:

(12) Not disclose sensitive data in a sale of personal data unless all of the following apply:

a. The dis

closure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains.

b. The controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed.

c. The controller obtains the consumer’s consent.

d. The controller maintains a record of the consumer’s consent for a period of 5 years.

e. The record of consent of Delaware consumers must be provided with any data protection assessment produced under § 12-108(c) of this title.

FURTHER AMEND

House Bill No. 380 by inserting the following after line 192 and before line 193:

(g) Nothing in subsection (f) of this section applies to a controller or third party when the report or personal data consists of a score, a model, an algorithm, or similar output that is a consumer report, or would be a consumer report if furnished to a third party, and is furnished or disclosed in compliance with the Fair Credit Report Act, 15 U.S.C. § 1681 et. seq.

SYNOPSIS

This Amendment contains the same changes to House Bill No. 380 as Amendment 1 to House Bill No. 380, with the exception that it changes exceptions to the disclosure of sensitive data to apply only to the disclosure of sensitive data in a sale of personal data, and clarifies that the chapter does not apply to federal or state chartered banks, credit unions, savings associations, or affiliates or subsidiaries thereof that are principally engaged in financial activities.