Senate committee hears hours of testimony on SB258, a proposed data‑privacy and AI law; sponsors and industry differ on scope

Senator Jared Penzo introduced Senate Bill 258 on Oct. 12 in the Senate Public Health, Welfare and Labor Committee and led a multi‑hour hearing in which privacy experts and a range of industry, trade and citizen witnesses testified for and against the proposal.

Penzo invited two privacy experts to present the bill: Josh Bryant, who described himself as a fellow in information privacy with certifications from the International Association of Privacy Professionals, and Katie Butler, an attorney and fellow of information privacy. “Technology has just outpaced the law,” Bryant said, arguing the bill adopts widely used fair‑information principles such as data‑minimization and purpose limitation. Butler summarized exemptions and applicability rules, emphasizing that entities regulated by the Gramm‑Leach‑Bliley Act, HIPAA, FERPA and state agencies would be excluded from most of the bill’s requirements and that small businesses and most nonprofits would be exempt under the thresholds in the draft.

Key provisions described by the sponsors and witnesses include:

- Consumer rights to access, correct and delete personal data and an opt‑out for sales of personal data; a consent mechanism for sales and sensitive…