While state data privacy legislation is picking up across the U.S., a California bill that just passed the State Senate and has remained largely under the radar, has some privacy experts raising alarm bells.

California's "Public Right to Know Act," or SB 1149, would curtail settlement agreements that don't disclose information about environmental hazards or defective products that are discovered during litigation. To be sure, there are exemptions for disclosing personally identifying information (PII) and medical information in these situations. But they only extend to individuals directly involved in the case, leaving third-parties mentioned in the settlements vulnerable.

For some attorneys, the bill would not only complicate discovery by eliminating the option of entering into a protective order, but also conflict with existing data privacy laws such as the California Consumer Privacy Act (CCPA) or the EU's General Data Protection Regulation (GDPR).