Rep. Russo Introduces the Ohio Privacy Act

COLUMBUS — State Rep. Allison Russo (D-Upper Arlington) today introduced the Ohio Privacy Act, a bill that would bar state entities from collecting, recording, or sharing an individual’s identifying information or personal data unless otherwise required by law or permitted use for operations, strengthening privacy protections for Ohio residents.

“Government use of personal information relies on public trust, and Ohio has a compelling interest and obligation in protecting individuals’ privacy and personal information,” said Representative Russo. “This legislation provides clarity and transparency for all Ohioans who are required to provide their personally identifiable information to state government entities. Trust is built when agencies are transparent about data collection policies, provide clear, plain-language privacy notices, and use data only for the purpose explained to the public”

If passed, the Ohio Privacy Act would mirror the federal Data Privacy Act and limit the data that state government agencies and employers may collect to include only the data that is necessary to administer public programs and meet reporting requirements. This bill would also prevent a state government agency from sharing large sets of data absent a court order, judicial warrant, or as is otherwise required by law, or when it falls into a set of specified permitted uses. When a set of data is shared, it must be de-identified and aggregated to the greatest extent possible.

The introduction of this bill follows widespread attempts by the federal government to acquire large-scale personal datasets from universities and state governments. Secretary of State Frank LaRose also recently provided the full voter files of nearly 8 million Ohioans, which included individual SSNs and driver’s license numbers, to the U.S. Department of Justice without clear legal authority for the DOJ’s request. Several states, including Montana, Nevada, and Illinois, have recently introduced legislation in response to concerns over unrestricted access to personal data and its potential for misuse, and many other states already have these protections in place.

The Ohio Privacy Act heads to the House to await a bill number.