State Data Protection Legislation Resources

MBA is providing this resource center to its member companies, state and local real estate finance associations and partner trade groups to help engage with state policy makers working to strengthen their consumer data protection laws. As part of this debate, it is important to recognize not just the necessity of sharing and validating data in real estate finance, but to also appreciate that this system is already subject to robust federal consumer protection laws and rules. State data protection bills must not unintentionally impede homeownership. To help inform the policy discussion on these issues, MBA is providing suggested legislative language for consideration in state bills as well as other support materials and information.

Resources You Can Use

As state legislatures consider data protection bills during the 2020 state legislative season, MBA is offering these documents to help inform the debate and help advocate for the needs of the real estate finance industry:

• MBA Data Protection Principles
• MBA Proposed Amendment Lanugage for State Legislation
• Sample Letter to Policy Makers Asking for Consideration of Proposed Amendment Language
• Frequently Asked Questions Regarding Data Protection Bills
• Suggested Real Estate Finance Industry Talking Points on Data Protection Bills

The following are key laws and regulations governing the real estate finance industry with respect to consumer information:

• Gramm-Leach-Bliley Act Safeguards Rule
• Gramm-Leach Bliley Act Financial Privacy Rule
  
• Californinia Consumer Privacy Act (CCPA) Statute
• CCPA Regulations
• Nevada Statute (SB-220)

Proposed Legislation, Recent Articles and Other Resources

Proposed Legislation, Recent Articles and Other Information and Resources

• March 28, 2023: Iowa Governor Kim Reynolds signs consumer data protection bill into law. Legislation includes Gramm-Leach-Bliley Act (GLBA) exemption for financial institutions and data. 
• February 9, 2022: Ohio data privacy legislation (HB 376) passes House Government Oversight Committee. It would exempt institutions and data governed by the Gramm-Leach-Bliley Act. It would also exempt activities regulated by the Fair Credit Reporting Act. In addition, the bill gives the state attorney general exclusive authority to enforce the bill’s provisions, and there is no private right of action. HB 376 is consistent with Virginia data privacy law.
  
• February 7, 2022: Oklahoma introduces data privacy legislation (HB 2968).
  January 24, 2022: Alaska introduces a comprehensive data privacy bill (HB 222).
• June 23, 2021: Colorado enacts data privacy legislation with a GLBA exemption consistent with Virginia and the MBA model.
• May 12, 2021: New York introduces comprehensive data privacy legislation that would provide a GLBA exemption for data.
• April 28, 2021: Florida legislation (SB1734) is tabled and will not move forward. Bill is not consistent with Virginia or MBA model.
• April 11, 2021: Washington data privacy legislation (SB5062) that would create a private right of action fails to proceed. MBA opposed the inclusion of a private right of action in the bill.
• March 2, 2021: Virginia enacts legislation consistent with the MBA model language that creates a GLBA exemption for both data and financial institutions