State-level comprehensive privacy laws typically take several years to pass, with most legislatures requiring two years or more to finalize a bill. Indiana is currently on the path to enacting a comprehensive privacy law, as Senate Bill 5 on consumer data protection has received unanimous approval in both the Indiana House and Senate. The bill includes coverage thresholds for entities handling personal data, data protection impact assessments, provisions for processing deidentified or pseudonymous data, user opt-outs for targeted advertising and data sales, and a 30-day cure provision. If signed by Governor Eric Holcomb, the law will go into effect on January 1, 2026. This case illustrates the time-consuming process involved in passing comprehensive privacy legislation at the state level.

Indiana has emerged as a leader in tackling complex data privacy and cybersecurity challenges, largely thanks to the proactive involvement of the state's attorneys general. In this series of interviews, the International Association of Privacy Professionals (IAPP) has previously engaged with former Indiana attorneys general Greg Zoeller (2009-2017) and Curtis Hill (2017-2021) during their respective tenures, discussing a range of issues such as combatting robocalls, safeguarding sensitive health information, and other topics at the intersection of privacy policy and consumer protection. Now, the focus turns to Indiana Attorney General Rokita, who sheds light on federal and state privacy regulations, cybersecurity concerns, and more.

In an unexpected development, Indiana has emerged as a potential frontrunner for passing comprehensive privacy legislation in 2022. The state's Senate Commerce & Technology Committee voted unanimously, with a 10-0 margin, to advance Senate Bill 358 after only one hearing. This milestone clears a significant hurdle and paves the way for the bill to progress through the Senate. Unless faced with objected amendments, SB 358 requires just two floor votes to proceed beyond the chamber. Indiana lawmakers are demonstrating their commitment to addressing privacy concerns, marking an interesting development in the state's legislative landscape.

Ted Cotterill, CIPP/US, the Chief Privacy Officer of Indiana, emphasized the importance of Indiana's privacy policies and their successful implementation in managing data sharing during the COVID-19 pandemic. Cotterill encouraged other state Chief Privacy Officers to consider Indiana's approach as they navigate data sharing challenges. He highlighted the effectiveness of Indiana's Management Performance Hub, a program that facilitates data sharing by removing legal and technical barriers. Cotterill noted that Indiana's interagency default has shifted to a positive stance, enabling smoother and more efficient data sharing. The state's privacy preparedness has proven invaluable in addressing privacy concerns while enabling effective data management during the pandemic.

Curtis Hill, the 43rd attorney general of Indiana, shares insights into his role and priorities in an interview with The Privacy Advisor by IAPP. Hill, who took office in January 2017, has built a reputation for his tough stance on crime as well as his efforts to work with defendants to prevent incarceration for lesser offenses. Throughout his tenure, he has focused on curtailing federal overreach, protecting consumers from fraud and scams, and maintaining a strong stance against crime. As Indiana's attorney general, Hill has also prioritized data privacy and security enforcement, setting the tone for the state. In the interview, he discusses Indiana's consumer protection initiatives related to data privacy and cybersecurity, shedding light on his approach and objectives in these critical areas.