With the forced distribution of workers as a result of the COVID-19 pandemic, as well as the natural evolution of the "information age", data and data protection have acquired a significant amount of attention across all levels of society.
Businesses, regulators, consumers, employees, investors, and even lawyers are all looking at data protection as a critical path to success. To this end, there are a number of issues which will likely come to the forefront in 2021 and beyond
State Privacy Laws
While California was the first state to pass a (reasonably) comprehensive privacy law (as opposed to a cybersecurity law) it was not the only state to try. Since 2018, multiple states have tried and failed to pass California Consumer Privacy Act (CCPA)-style statutes. However, we are now seeing not just momentum, but actual progress in these state initiatives. Virginia passed its version of the CCPA (the Consumer Data Protection Act, or CDPA) on March 2, 2021. Washington State looks to be poised to pass their version of the CCPA. Additionally, Florida and New York have strong momentum in their legislatures to pass CCPA-style laws.
The big factors in these state initiatives are: 1) who gets to enforce the law, 2) scope of application, and 3) preemption by other laws. So far, we haven't seen a law permitting a private right of action pass out of a state house. However, proposals permitting such private rights of action have been included in the drafting process for all of the state bills. Should a private right of action appear, we can expect significant litigation under these statutes as the practices that these laws regulate are central to most of how commerce happens.
The scope of who the law applies to, and what constitutes personal data are also evolving. The CCPA originally applied to everyone, and any data about everyone. The trend we are seeing now is the narrowing of the scope of individuals the law applies to (generally just “consumers”) but the expansion of the scope of data covered. Biometric data, event data recorder data (vehicle “black box” data), wellness data (non-health care data), “wearable” data, and even “Internet of Things” device data is now all subject to the requirements and restrictions of the expanding universe of state privacy laws.
One of the challenges with these new laws is that they are designed to limit the scope and uses of data. However, there are a number of existing state and federal laws which implicate the data handing practices addressed in the privacy laws. While each of the state privacy laws attempt to carve-out exemptions for existing regulations, these exemptions (e.g. HIPAA, Gramm-Leach-Bliley, Fair Credit Reporting Act (FCRA), etc.) are not always consistently drafted. The exemptions can even be drafted in different ways in the same act. For example, the CCPA exempts “any activity” governed by the FCRA, but only exempts “entities” governed by HIPAA. This type of drafting at a minimum creates confusion as to the scope of the exemptions. It is quite possible that such confusion will also create litigation when the enforcement actions start to pick up steam.
Privacy Is Everywhere
As the world becomes a smaller and smaller place, with the ever increasing expansion of interconnectivity across geopolitical boundaries, data protection becomes a much more significant issue. Whether it is workforce management, M&A activity, or entering into new markets, all “first” and “second world” countries have data protection laws. Many of these are modeled off of the EU's General Data Protection Regulation. As such, while the US is currently struggling to birth its own approach to data protection, almost all of our international trading partners have strong data protection laws. This is not limited just to the European continent. It includes places like Mexico, Argentina, Colombia, Israel, Japan, and Egypt. As a result, businesses which deal in data (and that is all of them – see third point below) are now having to take data protection regulation into consideration across all of their operations. Otherwise, they run the risk of significant fines and costly litigation. Even in those jurisdictions where litigation isn't as common as in the US, the functional regulators are seeing data protection fines as a means to self-fund their offices. There is a very real financial incentive for enforcement actions under the various data protection laws.
Data Is a Capital Asset
With the increasing number of privacy laws which are being proposed and passed at the state level, as well as the implication of international data protection laws in many modern businesses, there is a tension between the ability of a business to leverage and monetize data as an asset. This is becoming more important as well, as most businesses recognize that the traditional way of operating is limited in terms of growth. All businesses are becoming “data businesses”. Retail is looking at how on-line marketing, retargeting, and related data-heavy practices can improve their profitability. In fact, with the pandemic, retailers are facing a reality where on-line property is more valuable than brick-and-mortar properties. Retail isn't the only market to start to understand how “virtualization” is the wave of the future. Health care (telehealth), auto dealerships (Vroom and Carvana), banking, manufacturing, and utilities are all industries which are looking to improve their profitability via the use of data. As is the case with any valuable capital asset, disputes arise, regulation is developed, and “reasonable protections” are necessary to ensure that the appropriate parties have their rights protected.
Unlike traditional capital assets, data as a capital asset will always have at least one additional stakeholder in the equation–the individual data subject. As a consequence, businesses need to develop not just an understanding of how to monetize data, but also how to benefit the data subjects who make up a critical part of the ecosystem. This includes implementing “reasonable” information security – an obligation which is being included in all the various privacy laws at the state and federal level. Additionally, we expect to see management and owners of businesses start to view information security the same way they do financial reporting and other asset management and control systems. This will likely lead to increased scrutiny by lawyers for the various stakeholders to ensure that the asset isn't being abused. As part of this scrutiny, we predict that new and novel legal theories will start to show up in litigation, contract negotiation, and even insurance policies which address the needs for businesses (and their vendors) to consider information security and privacy in the same manner that quality is addressed. Theories like breach of fiduciary duties, waste, negligence, fraud, unfair or deceptive trade practices, may be used to impose liability on data supply chain participants who don't take proper precautions in ensuring a proper legal basis for processing, or in securing data. All of the existing legal risks associated with asset management will start to get applied to data protection. It won't be just about “privacy” any more. It will be about “responsible information management” or “data governance”.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
