House advances data-privacy bill, removes emergency clause and sets effective date to 2027

The Oklahoma House advanced and passed Senate Bill 5 46, a data-privacy measure that creates consumer rights over personal data, imposes response timelines for businesses and establishes penalties for violations. Floor amendments adopted in committee removed an emergency clause and set the effective date to Jan. 1, 2027.

Representative Josh West, sponsor of the floor amendment and the bill, described the legislation as the product of several years of work, saying it covers businesses that collect data about more than 100,000 consumers or control the data of at least 25,000 consumers or derive more than half their revenue from selling personal data. The bill grants consumers access to categories of data collected about them, the ability to see where their data went and a "right to be forgotten," and it allows businesses multiple methods for responding to consumer requests.

West said the measure exempts federal-regulated entities (HIPAA, the Fair Credit Reporting Act and Gramm-Leach-Bliley) and will be enforced through the attorney general's consumer protection division, with penalties set at $7,500 per violation. He pointed out the wider national trend and referenced settlements in other states as precedent for enforcement efforts.

Representative Olsen asked about exemptions for state agencies, political subdivisions, nonprofits and health records; West replied those exemptions are not part of this bill and suggested further bills next year to extend exemptions.

The roll call on final passage was recorded as 84 aye and 4 nay, and the Speaker declared the bill passed. The adopted floor amendments included a substitute that removed the emergency clause and restored the bill's title; the effective date was moved to Jan. 2027.