In this recurring blog series, Entrata will review the latest legislation for you to help ensure you are in the loop and don’t fall out of compliance and are prepared for upcoming deadlines. However it is important to note, the information contained herein is general in nature and is not intended to provide, or be a substitute for, legal analysis, legal advice, or consultation with appropriate legal counsel. You should not act or rely on information contained in this document without seeking appropriate professional advice.

With data privacy laws, tenant rights, and fair housing laws constantly being passed, amended, and changed, it can be hard to stay on top of it all and how this legislation impacts your business practices. Especially with everything else you’ve got on your plate, but don’t worry. That’s what we’re here for. Entrata is built with data privacy and security standards in mind to offer assurance to both end users and clients

To help you stay on top of everything, we’ll publish a running list of new legislation to make sure you have all the resources you need to stay compliant.

Data Privacy

Defined terms - Many of the newly passed data privacy bills use the language of controller and processor when describing the ownership of the data. This language is derived from the GDPR which defines a controller as the legal entity who determines the purposes and means of processing of personal data. Subsequently, a processor is defined as a legal entity which processes personal data on behalf of the controller.

Montana Consumer Data Privacy Act Effective: October 1, 2024

This law only applies to businesses that produce products or services targeted at Montana residents and process the personal information of 50,000 or more in the state (approximately 10% of the state’s population. In this case, the term sale is defined as any monetary exchange or exchange of other valuable considerations. This is in line with other data privacy laws already enacted in California, Connecticut, and Colorado. Under this law individuals have the right to delete, access, and opt out of the sale of their personal information. However, this law does not provide the private right of action.

Tennessee Information Protection Act Effective: July 1, 2024

This bill applies to persons that conduct business in this state or produce products or services that are targeted to residents of this state and that control or process personal information of at least 100,000 consumers during a given year; or control or process personal information of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal information. This law describes personal information as any information that identifies or relates to a particular consumer. Under TIPA a controller or processor must create, maintain, and comply with a written privacy program that reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework. Additionally, this law does not provide the private right of acton.

Iowa Consumer Data Privacy Act Effective: January 1, 2025

This bill provides consumers the right to access, delete, portability, and opt out. It requires controllers that engage in targeted advertising to “clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out of such activity.” However, it does not require an opt-in for sensitive data processing, which is inline with requirements in Utah and California. The Iowa CDPA does not provide the private right of action.

Indiana Consumer Data Privacy Act Effective: January 1, 2026

Controllers are required to provide a Data Protection Impact Assessment if they perform targeted advertising, sell personal data, use data for the purposes of profiling, process sensitive personal data, along with any activity that presents a heightened risk. Consumers have the right to access, right to correction, right to deletion, right to data portability, and right to opt out, but are not provided with the private right of action.

Texas Data Privacy and Security Act Effective: July 1, 2024

This is one of the most restrictive privacy bills to be passed since California’s CCPA and CPRA. It will require controllers to conduct data protection assessments on processing activities that pose risks to consumers. The impact assessment requirements match those found in the Connecticut Data Privacy Act. It provides the right of deletion, to correct inaccuracies, right to access, and right to opt out, but no right to private action.

Oregon Consumer Privacy Act Effective: July 1, 2024

This law requires an affirmative opt-in for sensitive data, including precise geolocation, genetic/biometric information, personal information revealing racial or ethnic background, physical condition, or diagnosis, or gender identity. It provides consumers with the right to know, right to correction, right to deletion, right to opt out, and the right to data portability. It also requires a comprehensive privacy policy which should include categories of data processed, purposes for processing, and categories of data shared with third parties.

Tenant Rights

Colorado HB 1099 (concerning tenant screening documentation for residential leases) Effective: 8/1/2023

This law requires a landlord to accept a portable tenant screening report along with informing prospective tenants that they accept screening reports. It prevents the landlord from assessing fees if a valid report is provided. If the landlord denies the prospective tenant based on a consumer report that was provided by the landlord or the landlord’s agent, a copy of the screening report must be provided along with the ability to dispute the accuracy of the report.

Colorado HB 1095 (Restrictions on leases) Effective: 8/1/2023

HB 1095 establishes new guardrails concerning the award of attorney fees in an eviction. It prohibits most leases from including clauses that waive the right to a jury trial, a class action lawsuit, the “implied covenant of good faith and fair dealing,” and the implied “covenant of quiet enjoyment.” It also limits the imposition of “lease non-renewal” fees and other third-party fees, while also restricting leases from characterizing fees and utilities as “rent” for the purposes of an eviction.

Colorado SB23-184 (Restrictions to Application inquiries and Security Deposit) Effective: 8/1/2023

SB23-184 Restricts a landlord from considering or inquiring about certain information relating to a prospective tenant’s “amount of income” and credit history. It prohibits a landlord from requiring a security deposit in an amount that exceeds the amount of two monthly rent payments. Violation of any of the bill’s new prohibitions is an unfair housing practice and is subject to enforcement by private persons, the attorney general, and the Colorado Civil Rights Division.

Colorado SB23-1068 (Pets and Rental requirements) Effective: 1/1/2024

SB23-1068 limits the amount of additional security deposit a landlord can receive from a prospective or current tenant as a condition of permitting the tenant’s pet animal to reside at the premises to a refundable $300. A landlord is prohibited from demanding or receiving additional rent from a tenant as a condition of permitting the pet to reside at the premises in an amount that exceeds $35 per month or 1% of the monthly rent, whichever is greater. Additionally, SB23-1068 excludes pet animals from the categories of a tenant’s personal property as it relates to liens against the renter.

Fair Chance Housing

California’s Alameda County Fair Chance Housing Adopted: 12/6/2022

Fair Chance Housing legislation regulates when and how a landlord may ask about and use arrest and/or conviction records in evaluating a potential tenant. The legislation prohibits the use of criminal histories for most offenses in determining access to housing, while also instituting a ban on the use of advertising language that excludes or discriminates against individuals with criminal histories, including arrest and conviction records.

Lease Disclosure Requirements

Texas Lease Disclosure Requirements

Texas Property Code Title 8-92 A requires Texas landlords to provide disclosure of things like lead based paint, name and address of the person authorized to manage the property, and name and address of the property owner’s agent. In October 2022, the Texas Supreme Court expressed skepticism that this law gives a class of tenants standing to sue when landlords fail to include mandated disclosures in lease documents, but did confirm that the law does require the disclosure to be included in all leases. (American Campus Communities Inc. et al v. Berry et al).