Committee advances bill limiting government purchase and retention of personal data, sets phased compliance dates

Senate File 65, a bill to restrict how government entities collect, purchase, transfer and retain personal data, passed the House Minerals, Business & Economic Development Committee with a recommendation of due pass after extended discussion about enforcement and exceptions. Sponsor Senator Rothfuss presented the bill as the product of two years of work out of the Blockchain Select Committee.

The measure would bar government entities from purchasing, selling, trading or transferring personal data without the express written consent of the natural person, while creating explicit exception pathways for transfers between compliant government entities, contracted nongovernmental entities that agree to protections, and by petition for a written public exception from an elected governing official for up to two years. The bill would also require entities that collect personal data to adopt written collection and retention policies and generally limit retention to three years unless an express written justification is recorded.

The bill’s sponsor said the measure attempts to balance privacy with government operations. "Privacy is inconvenient for government. So it takes a little bit of work to get to the point where you're threading the needle appropriately," Senator Rothfuss said as he walked committee members through the definitions and exceptions.

Committee members pressed on enforcement. Representative Malauley and Representative Lawley both raised concerns that, as drafted, the bill lacks strong private remedies; Rothfuss said that was intentional for an initial implementation phase and that courts remain available. "Step one is provide an obligation to try and protect policy," the sponsor said, adding that he expects lawmakers to revisit remedies after agencies have implemented policies.

Other provisions spelled out federal preemption and compatibility: the bill deems that where it conflicts with other state or federal law, the other provision controls. It also explicitly deems compliance with HIPAA or FERPA to satisfy the bill’s data-handling requirements in areas governed by those federal statutes. The bill tasks the state Office of Enterprise Technology Services (ETS) with publishing model policies by Jan. 1, 2026, and establishes staggered effective dates: state agencies by July 1, 2026; cities, towns and counties and public higher education institutions by July 1, 2027; and other political subdivisions by July 1, 2028.

Officials from the Secretary of State’s office raised a narrow concern about how the bill’s language would interact with mandated exchanges of voter‑registration data under the Help America Vote Act (HAVA). Joe Rubino, policy director and general counsel for the office, asked for explicit statutory clarity to preserve the routine, interstate sharing of voter‑registration withdrawal reports. Rothfuss and witnesses discussed contractual safeguards and the bill’s exception pathways; the sponsor said the secretary of state could rely on the bill’s exception language or sign a public written exception if necessary.

ETS director Jeff Clines testified the agency was neutral and willing to produce the sample policies required by the bill. County assessors and associations representing banks and title agents spoke generally to watchfulness, saying that public-records releases and real-estate data should remain usable as public information.

Action: The committee took a roll-call vote and recommended a due pass. The roll call recorded Representative Campbell, Representative Larson, Representative Lolli, Representative Schmidt, Representative Tarver, Representative Weber and Chairman Heiner voting aye; Representative Knapp voted no; Representative Reagan was excused.

The sponsor said the bill would be phased in to give agencies time to adopt policies and produce guidance. He also said the statute provides an administrative pathway for exceptions so elected officials must publicly justify any transfer of personal data that would otherwise be restricted.

If enacted, SF 65 would create a state statutory framework requiring written data‑collection and retention policies, a default three‑year retention period absent written justification, access and correction procedures for residents, and public exception procedures to accommodate government workflows and statutory authorities.