Follow the Leader
Implications of California’s New Privacy Law: The CCPA
For those of you just getting comfortable with the CCPA, California’s privacy law that just went into effect, hold on to your hats because a new storm of privacy regulations is about to be unleashed. Five more states are scrambling to keep up with the trendy West Coast with new or revised privacy legislation on the books for 2020: New York, Washington, Florida, Nebraska, and Virginia. Some of these bills reflect many of the same parameters set forth in the CCPA, while some are better (and some are worse).
New York:
The New York Privacy Act (NYPA), was introduced again this year after failing to go through last year. Highlights include creating a private right of action for consumers to sue for violations of the law, express and documented (opt-in) consent to use personal data; and creating the duty of care, loyalty and confidentiality – in other words, a fiduciary duty – to the consumer.
Washington:
The Washington Privacy Act (Senate Bill 6281), also a repeat visitor from last year, was reintroduced in 2020. This law would grant Washington residents with rights to access, correct, delete, port data and opt-out of sale, profiling and targeted advertising (similar to the CCPA). Several other bills were also introduced with a range of privacy focuses including rights to biometric identifiers, regulation for connected devices, and annual registration requirements for all data brokers with the Washington Office of Privacy and Data Protection among others.
Florida:
Lest the home of Disneyland miss out, Florida has joined the fray with the introduction of consumer privacy bills that would prohibit the use of personal data contained in public records for certain marketing, soliciting and contact without the person’s consent; place additional requirements on website or online service operator and prohibit operators from selling consumer data upon the request of the consumer, among others.
Nebraska:
The Nebraska Consumer Data Privacy Act (Nebraska bill) has been introduced to “enhance the protection of private online data.” This bill would apply to any for profit company doing business in Nebraska that collects consumers personal information and meets certain other criteria set forth in the law, some of which are very similar to the CCPA.
Virginia:
House Bill No. 473 (Virginia bill) would amend Virginia law to add the Virginia Privacy Act. This bill will apply to any company doing business in Virginia or that produces products or services “intentionally targeted to residents” of Virginia and that meet other criteria as set forth in the law. This law has similarities to both the CCPA and the GDPR.
Why This Matters
In the past few years, there has been a unified effort by the advertising industry for a national privacy law, one that won’t leave marketers and advertisers struggling to comply with fifty different sets of regulations. We don’t yet know which laws will pass but without a federal law, which would preempt the state laws, this issue should remain top of mind.