Emerging Technologies Legal Perspective
(by Justine Kasznica)
In 2018, California signed into law the first state-level comprehensive privacy act, the California Consumer Privacy Act of 2018 (CCPA), which will go into effect Jan. 1, 2020. In part due to the CCPA’s broad scope and reach beyond California, as well as the large fines and penalties for CCPA noncompliance, the law is influencing and setting a high bar for data protection practices nationwide. Since the CCPA was signed into law, several states have proposed or enacted similar legislation, turning privacy and cybersecurity into a patchwork of state-led experimentation.
We are seeing more states joining California and developing their own privacy laws, which will make it difficult for companies to track and comply with every state’s privacy act, not to mention the privacy regimes in non-U.S. jurisdictions, such as Europe’s General Data Protection Regulation (GDPR).
While some states are beginning to enact or consider uniform approaches to privacy and cybersecurity, such as the NAIC Model Law for Cybersecurity, it will take time for such models to emerge and achieve the requisite consensus. In the absence of a uniform federal and state approach to privacy, businesses need to take the initiative now and be aware of the various state, federal and foreign laws being introduced and enacted — even if their operations may not yet affected.
How does California’s privacy act work?
The California Consumer Privacy Act of 2018 (CCPA) protects consumers who are residents of California by giving them rights to disclosure, access, deletion, control (opt-out and portability rights) as well as imposing a prohibition on antidiscrimination. It also addresses the data privacy rights of children under the ages of 13 and 16. …