PERHAPS NO AREA of law is evolving more quickly—or is closer to top of mind for in-house attorneys, organizations and private practitioners—than data privacy, data protection and cybersecurity. Chief privacy officer was a role seldom seen in the C-suite even 15 years ago, but it’s now common at most companies. In the last half-decade or so alone, new data protection regimes have been introduced in the European Union and United Kingdom as well as in California. These necessitate significant operational and compliance changes for many organizations regardless of the sector within which they operate.
Over the next 12 months, at least four states—Virginia, Colorado, Utah and California again—will see new or greatly expanded consumer privacy legislation take effect. This means that many groups are addressing—some for the first time—how to respond to this fast-evolving area of the law.
Women, whether in-house counsel or in private practice, are in a unique position to lead this response. The International Association of Privacy Professionals (IAPP) estimates that equal numbers of women and men make up the privacy field, a rarity in both technology and the law. Below are four common myths about data privacy, and four steps all organizations can take to prepare to address imminent legal changes.
Myth 1: There will soon be a federal law covering consumer privacy, so my organization or client shouldn’t expend energy implementing a response to current regimes.
Many privacy experts speculate—perhaps even hope—that Congress will soon pass federal consumer data protection legislation. Others posit that rather than preempting state legislation, a federal law may instead simply set a floor for consumer privacy rather than a ceiling, leaving room for states to continue to legislate and impose restrictions above the federal baseline. Furthermore, sector-specific laws regarding health, finance and education data will likely continue to exist. Accordingly, while practitioners and organizations can hope that for simplicity’s sake federal legislation will soon pass, they should remain skeptical that Congress will fully solve the current patchwork.
Myth 2: My organization or client already implemented a program in response to Europe’s General Data Protection Regulation (GDPR), so as new state laws roll out, we’ll be covered.
Organizations that implemented privacy programs in response to GDPR, the EU’s 2016 directive, are certainly in a good position to handle the various state laws, as most such legislation resembles or mirrors aspects of GDPR. But having a GDPR-compliant program doesn’t mean you’re automatically compliant with any given state legislation, each of which has various distinguishing nuances. Organizations must evaluate their existing program to determine what, if any, changes they might need to make.
Myth 3: My organization or client is too small and does not have the budget to continually address the changing privacy landscape.
Most privacy legislation has a threshold that an organization must meet to be considered compliant, but the minimum required gross revenue is often low and can sweep in even small or midsize businesses. Past enforcement has focused not just on big-name companies, but also smaller fry, so simply ignoring new or existing regimes can create significant regulatory risks. Furthermore, even if your organization doesn’t have the budget of, say, a large tech company, a privacy program can be built to scale. Small changes, such as ensuring that your privacy notice is reviewed regularly and is up to date with changing laws, or implementing vendor contracts, are relatively modest steps that go a long way toward achieving compliance.
Myth 4: Privacy is currently a hot legal trend, but it’s a fad that will disappear in a few years.
While the field of privacy law is fairly new, legal restrictions on how organizations can collect, use and share information have been around for nearly 50 years. Groups in highly regulated areas such as health care, finance, government, critical infrastructure and education have been dealing with sector-specific privacy approaches for decades. Even though the last few years have seen an influx of new laws—and consumer privacy seems to be at the forefront of many legislators’ minds—the need to comply with regulations will still exist in the years ahead even if the flurry of legislation eventually slows.
It can all seem exceedingly complicated. If your organization or client has no idea where to start addressing consumer privacy, here are four steps to help guide you.
1. Determine which laws apply to your organization.
Every state law has various thresholds that a firm must meet to be required to comply. Moreover, Europe’s GDPR has broad territorial scope and often applies to entities outside the European Economic Area. The U.S., meanwhile, has additional sector-specific laws as outlined above. Understanding which apply to your group will help you devise a compliant program.
2. Map your data.
Determine which types of data you collect from each category of individual with which your organization interacts (customers, vendors, employees, website visitors) and whether that information is ever shared with third parties. This will help you craft strategies for vendor management, handle rights requests from individuals pursuant to various legislation, develop proper privacy notices and obtain correct consent when applicable.
3. Educate critical stakeholders and empower people within your organization to “own” data privacy measures.
Organizational buy-in is key to achieving a functional and compliant privacy program. Companies greatly benefit when their employees understand the stakes and can assist with compliance. Having an internal point person or team to respond to privacy inquiries on behalf of the broader firm can make establishing and running a program less daunting.
4. Analyze current “notice and consent” mechanisms already in place and revise them as appropriate.
Most consumer privacy regimes are built according to a “notice and consent” model, meaning that an organization has an obligation to notify consumers how it collects, uses and shares data, then to obtain consent (either opt-in or opt-out). Companies should examine whether and when they currently provide notice to individuals from whom they collect data, and how they manage obtaining consent or respecting an individual’s choices regarding its data practices.
This generally means reviewing one’s privacy policy regularly, ensuring that it encompasses all information use, collection and sharing, and making sure internal procedures are in place to address the requirements of various privacy laws, including procedures for handling consumers’ requests to exercise their rights.
This evolving body of law can seem like an utterly complex series of new requirements but dispelling the most common myths to others in your organization, or to your clients, and then taking a few initial steps to address legal compliance can go far toward creating a robust privacy program.
Casey Waughn is an Associate at Armstrong Teasdale LLP. She helps clients navigate and comply with complex regulatory regimes, particularly in the data privacy, cybersecurity and white-collar spaces. As a data privacy practitioner, Waughn counsels clients to develop, implement and maintain practical privacy and data protection strategies to fit their organization’s needs.
