Washington, D.C., Becomes the First Mover on the Uniform Personal Data Protection Act

This past summer, we reported on the July 2021 vote by the Uniform Law Commission (ULC) to approve the Uniform Personal Data Protection Act (UPDPA), a model data privacy bill designed to be promulgated in state legislatures across the United States. Now the District of Columbia becomes the first jurisdiction to have the bill introduced for consideration. On October 18, 2021, District of Columbia Council Chairman Phil Mendelson introduced B24-0451, also known as the "Uniform Personal Data Protection Act of 2021" to the council. Accompanying the text of the bill is a letter from James C. McKay, Jr., the Chair of the D.C. Uniform Law Commission, outlining why the UPDPA should be adopted. In support of his request to Chairman Mendelson to introduce the bill, McKay describes the UPDPA as a bill that "would provide real protections for consumers' personal data without imposing onerous, and often impossible, burdens on controllers and processors," and noting that, if enacted, the law "will encourage the responsible growth of data practices in the District." Indeed, it appears that the bill is essentially identical to the version of the UPDPA approved by the ULC. The bill has now been referred to the Committee on the Judiciary and Public Safety. If adopted, the law would apply to any controller or processor that conducts business in Washington, D.C., or produces products or provides services purposefully directed to its residents, and which:

1. Maintains personal data about more than 50,000 residents of Washington, D.C.;
2. Earns more than 50% of its gross annual revenue from maintaining personal data;
3. Is a processor acting on behalf of a controller the processor knows or has reason to know satisfies (1) or (2); or
4. Maintains personal data, unless it processes the personal data solely using compatible data practices.