Oklahoma House Passes Data Privacy Bill Covering Employees

Each of the four states that have enacted comprehensive consumer privacy laws have excluded HR data from their provisions. This week, however, the Oklahoma House of Representatives passed a privacy bill that would require employers to delete or disclose any personal information about an employee upon that employee’s request.

Under the Oklahoma Computer Data Privacy Act (H.B. 2926), employers would also be required in many cases to disclose and obtain an employee’s consent to transfer their personal information to third parties. 

Such provisions could severely interfere with employers’ ability to administer basic functions of HR, including issuing paychecks, administering health care and paid leave benefits, and withholding taxes. In addition, many companies outsource the collection of processing worker data to ensure security and efficiency. Without language clearly excluding HR data from its provisions, the Oklahoma bill would undermine these legitimate business practices. 

The need for preemptive federal legislation grows: Four states—California, Utah, Colorado, and Virginia—have enacted comprehensive consumer privacy legislation, but the impact of the state patchwork has not yet been felt. The California Consumer Privacy Act is the sole comprehensive consumer privacy bill currently in effect, with Virginia’s bill going into effect January 1, 2023, Colorado’s on July 1, 2023, and Utah’s on December 31, 2023. As the Oklahoma legislature considers comprehensive consumer privacy legislation covering HR data, a preemptive approach to federal legislation that excludes HR data is more important than ever. Fortunately, federal congressional efforts to come to agreement are underway. Whether they are successful this year remains to be seen. 

Outlook: Last year, the Oklahoma House passed a similar bill which also covered HR data, while a Florida bill with a robust private right of action was passed by the state House. It is important to note that both the Oklahoma and Florida legislatures are held by Republicans. It will continue to be incumbent on the business community to educate state officials about the impacts of comprehensive data privacy reform—which extend far beyond the tech giants.