Senate committee hears hours of testimony on SB258, a proposed data‑privacy and AI law; sponsors and industry differ on scope

Senator Jared Penzo introduced Senate Bill 258 on Oct. 12 in the Senate Public Health, Welfare and Labor Committee and led a multi‑hour hearing in which privacy experts and a range of industry, trade and citizen witnesses testified for and against the proposal.

Penzo invited two privacy experts to present the bill: Josh Bryant, who described himself as a fellow in information privacy with certifications from the International Association of Privacy Professionals, and Katie Butler, an attorney and fellow of information privacy. “Technology has just outpaced the law,” Bryant said, arguing the bill adopts widely used fair‑information principles such as data‑minimization and purpose limitation. Butler summarized exemptions and applicability rules, emphasizing that entities regulated by the Gramm‑Leach‑Bliley Act, HIPAA, FERPA and state agencies would be excluded from most of the bill’s requirements and that small businesses and most nonprofits would be exempt under the thresholds in the draft.

Key provisions described by the sponsors and witnesses include:

- Consumer rights to access, correct and delete personal data and an opt‑out for sales of personal data; a consent mechanism for sales and sensitive categories of data. Butler explained that, operationally, consent would typically be collected and recorded electronically through consent‑management platforms.

- A broad definition of the “sale” of personal data that includes transfers for “valuable consideration,” not always monetary (the presenters used the Google Analytics example), subject to a number of exclusions such as transfers to service providers and affiliates.

- Exemptions: data subject to GLBA (financial institutions), HIPAA (health care), FERPA (education), state agencies and political subdivisions, and data processed for investigating or preventing fraud.

- Special handling and consent requirements for biometric data and for data of children under age 13; sponsors said minors under 13 would be treated as sensitive and require parental consent.

- Requirements for controllers and processors including privacy notices, data‑protection assessments for higher‑risk processing, data‑minimization, purpose limitation, security controls and prohibitions on dark patterns.

- Limited regulation of artificial intelligence focused on “high‑risk” systems that make legally significant decisions (eligibility for loans, bail, employment decisions, etc.), model cards and risk management; sponsors said general purpose models like chatbots would not be covered except where used in high‑risk decisionmaking.

- Enforcement by the Arkansas attorney general using existing consumer‑protection authority (the Arkansas Deceptive Trade Practices Act); the sponsors opposed a private right of action.

Industry witnesses urged narrowing the bill or separating its components. Renzo Sowell, testifying for TechNet, said his members support consumer privacy but warned the draft combines an expansive, untested AI regime with data‑privacy rules and could create compliance confusion and higher costs for Arkansas businesses. “The data privacy provisions within Senate Bill 258 are not the Texas law,” he said, pointing to differences on biometrics, processor duties and other language.

Randy Zook of the Arkansas State Chamber of Commerce and Laurie Trogdon of the Arkansas Bankers Association told the committee their members support strong privacy practices but raised concerns about state‑level differences from other models and overlaps with federal regulatory regimes. Trogdon urged a full GLBA exemption for banks, saying financial institutions already face FDIC and federal supervisory requirements around algorithms and discrimination.

Other witnesses included privacy professionals and Arkansas residents who said residents deserve clearer control over how companies collect, use and sell personal information. Amar Jabreen, an Arkansas privacy professional and parent, told the committee the bill would give Arkansans rights they lack today: “I want you to think about every single app that is on your smart devices in your homes that are listening to you. Do you even know what this microphone is doing?”

Committee members discussed the bill’s complexity and timetable. Several senators recommended splitting the measure into separate bills for data privacy and for AI to make the issues more digestible and give stakeholders time to negotiate adjustments; others urged moving quickly so Arkansas is not left behind. Senator Penzo agreed to work with stakeholders and indicated he would consider breaking the measure into multiple bills and return with amendments rather than sending the text to an interim study.

No committee vote was taken on SB258 during the hearing; the sponsor said he would pull the bill down, work with industry and return with revised language (potentially separate data‑privacy and AI bills).