Multiple privacy laws to update you about.
In California, lawmakers have debated and are considering new privacy laws for children. The rules are similar to what is happening in the UK, and once passed, it’s expected that other states will follow suit.
Arizona recently amended its breach notice law to change the regulator notification requirements. Starting this summer, depending on the scope of the incident, the Arizona Department of Homeland Security will need to be notified. Specifically, as amended, if more than 1,000 Arizona individuals are notified of a breach, the notification must be made to the three largest consumer reporting agencies, the Arizona attorney general, and the Arizona Department of Homeland Security.
Utah passed the Utah Consumer Privacy Act, which takes effect on December 31, 2023. The law applies to “controllers or processors” that do more than twenty-five million dollars and control the data of more than one hundred thousand consumers … or derive over 50% of revenue from the sale of personal data and have more than twenty-five thousand records.
Virginia just amended their law with three new additions. First, a right to delete was added. Second, the independent Consumer Privacy Fund was abolished, and fees now go right into the State Treasury, and the third redefined non-profit to include political organizations.
Why do we care?
Welcome to the future, full of multiple sets of regulations for data to be managed. This happens when laws are done at the state level rather than the federal one. Sure, that complexity is good for lawyers and tech services firms, who have a clear opportunity to help companies navigate this.
It’s just not as good for consumers … aka customers. I could make a pretty solid argument that it’s also not good for those tech services firms. Helping manage this is an SG&A expense, not a revenue-enhancing one, making it less than ideal for a technology spend. I’d instead trade the short-term complexity gains for the long-term simplicity, freeing resources to focus on moves that enhance income for customers, not cut expenses.