KLS Keeping Law Simple Legislation in plain English

Straight-ahead summaries built from the official bill text. We keep the source links front and center and leave the decision up to you.

Back to Delaware

HA2TOHB380 • 2025

This Amendment contains the same changes to House Bill No.

This Amendment contains the same changes to House Bill No.

Passed Legislature

This bill passed both chambers and reached final enrollment, even if later executive action is not shown here.

Sponsor
Griffith
Last action
2026-05-21
Official status
Passed 5/21/26
Effective date
Not listed

Plain English Breakdown

The official summary does not provide specific details on enforcement mechanisms or penalties, leaving these aspects unclear.

Amendment to House Bill No. 380

This amendment updates House Bill No. 380 by changing how sensitive data can be sold and clarifying exceptions for certain financial institutions.

What This Bill Does

  • Changes the definition of 'sale of personal data' to include selling sensitive information but not regular product or service requests.
  • Adds rules about disclosing sensitive data in sales, requiring clear notice and consumer consent before any sale happens.
  • Requires companies to keep records of consumer consent for five years when selling sensitive data.
  • Exempts certain financial institutions from the bill's requirements.

Who It Names or Affects

  • Companies that sell personal or sensitive information
  • Consumers whose sensitive data is sold by companies

Terms To Know

Sensitive Data
Personal information that needs extra protection, like health records.
Controller
A company or organization that decides how and why personal data is processed.

Limits and Unknowns

  • The bill does not specify what happens if a company violates the new rules.
  • It's unclear how this amendment will be enforced by regulators.

Bill History

  1. 2026-05-21 Delaware General Assembly

    Introduced and Placed With Bill

  2. 2026-05-21 Delaware General Assembly

    Passed In House by Voice Vote

Official Summary Text

This Amendment contains the same changes to House Bill No. 380 as Amendment 1 to House Bill No. 380, with the exception that it changes exceptions to the disclosure of sensitive data to apply only to the disclosure of sensitive data in a sale of personal data, and clarifies that the chapter does not apply to federal or state chartered banks, credit unions, savings associations, or affiliates or subsidiaries thereof that are principally engaged in financial activities.

Current Bill Text

Read the full stored bill text 
Legislation Document

SPONSOR:

Rep. Griffith

HOUSE OF REPRESENTATIVES

153rd GENERAL ASSEMBLY

HOUSE AMENDMENT NO. 2

TO

HOUSE BILL NO. 380

AMEND House Bill No. 380 by inserting the following after line 18 and before line 19:

"

(29)

( )

“Sale of personal data” means the exchange of personal data for monetary or other valuable consideration by the controller to a third party. “Sale of personal data” does not include any of the following:

b. The disclosure of personal data to a third party for purposes of providing a product or service affirmatively requested by the

consumer.

consumer, except that the disclosure of sensitive data for monetary or other valuable consideration by the controller to a third party must comply with § 12D-106(a)(2) of this title.

".

FURTHER AMEND House Bill No. 380 on line 51 by deleting “

directly

” as it appears therein and inserting in lieu thereof “

principally

”.

FURTHER AMEND House Bill No. 380 by inserting the following after line 59 and before line 60:

"

(15) Information created specifically for and collected and maintained by a manufacturer, as defined under 21 C.F.R. 820.3(o), when collected, used, or disclosed for treatment, payment, or health care operations purposes as specified under the Health Insurance Portability and Accountability Act of 1996.

(16) Information created for purposes of the Federal Health Care Quality Improvement Act of 1986 and related regulations.

(17) Information derived from protected health information regulated under the Health Insurance Portability and Accountability Act of 1996 or the Federal Policy for the Protection of Human Subjects under 45 C.F.R. Part 46, and deidentified as provided under 45 C.F.R. § 164.514.

(18) Information included in a Limited Data Set as described under 45 CFR § 164.514(e), to the extent that the information is used, disclosed, and maintained in the manner specified under 45 CFR § 164.514(e).

".

FURTHER AMEND

House Bill No. 380 by deleting lines 153 through 154 in their entirety and inserting in lieu thereof the following:

"

(12) Not disclose sensitive data in a sale of personal data unless all of the following apply:

a. The dis

closure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains.

b. The controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed.

c. The controller obtains the consumer’s consent.

d. The controller maintains a record of the consumer’s consent for a period of 5 years.

e. The record of consent of Delaware consumers must be provided with any data protection assessment produced under § 12-108(c) of this title.

".

FURTHER AMEND

House Bill No. 380 by inserting the following after line 192 and before line 193:

"

(g) Nothing in subsection (f) of this section applies to a controller or third party when the report or personal data consists of a score, a model, an algorithm, or similar output that is a consumer report, or would be a consumer report if furnished to a third party, and is furnished or disclosed in compliance with the Fair Credit Report Act, 15 U.S.C. § 1681 et. seq.

".

SYNOPSIS

This Amendment contains the same changes to House Bill No. 380 as Amendment 1 to House Bill No. 380, with the exception that it changes exceptions to the disclosure of sensitive data to apply only to the disclosure of sensitive data in a sale of personal data, and clarifies that the chapter does not apply to federal or state chartered banks, credit unions, savings associations, or affiliates or subsidiaries thereof that are principally engaged in financial activities.