Privacy Practice

Data protection is all the rage among tech companies and state, national (and even transnational) governments alike. Is it a passing fad or here to stay? And how should businesses and groups of all sizes handle compliance with a blizzard of new laws?

Data Protection Prompt New Privacy Laws

Casey Waughn

June 8, 2022 09:05 AM

PERHAPS NO AREA of law is evolving more quickly—or is closer to top of mind for in-house attorneys, organizations and private practitioners—than data privacy, data protection and cybersecurity. Chief privacy officer was a role seldom seen in the C-suite even 15 years ago, but it’s now common at most companies. In the last half-decade or so alone, new data protection regimes have been introduced in the European Union and United Kingdom as well as in California. These necessitate significant operational and compliance changes for many organizations regardless of the sector within which they operate.

Over the next 12 months, at least four states—Virginia, Colorado, Utah and Californiaagain—will see new or greatly expanded consumer privacy legislation take effect. This means that many groups are addressing—some for the first time—how to respond to this fast-evolving area of the law.

Women, whether in-house counsel or in private practice, are in a unique position to lead this response. The International Association of Privacy Professionals (IAPP) estimates that equal numbers of women and men make up the privacy field, a rarity in both technology and the law. Below are four common myths about data privacy, and four steps all organizations can take to prepare to address imminent legal changes.

Myth 1: There will soon be a federal law covering consumer privacy, so my organization or client shouldn’t expend energy implementing a response to current regimes.

Many privacy experts speculate—perhaps even hope—that Congress will soon pass federal consumer data protection legislation. Others posit that rather than preempting state legislation, a federal law may instead simply set a floor for consumer privacy rather than a ceiling, leaving room for states to continue to legislate and impose restrictions above the federal baseline. Furthermore, sector-specific laws regarding health, finance and education data will likely continue to exist. Accordingly, while practitioners and organizations can hope that for simplicity’s sake federal legislation will soon pass, they should remain skeptical that Congress will fully solve the current patchwork.

Myth 2: My organization or client already implemented a program in response to Europe’s General Data Protection Regulation (GDPR), so as new state laws roll out, we’ll be covered.

Organizations that implemented privacy programs in response to GDPR, the EU’s 2016 directive, are certainly in a good position to handle the various state laws, as most such legislation resembles or mirrors aspects of GDPR. But having a GDPR-compliant program doesn’t mean you’re automatically compliant with any given state legislation, each of which has various distinguishing nuances. Organizations must evaluate their existing program to determine what, if any, changes they might need to make.

Myth 3: My organization or client is too small and does not have the budget to continually address the changing privacy landscape.

Most privacy legislation has a threshold that an organization must meet to be considered compliant, but the minimum required gross revenue is often low and can sweep in even small or midsize businesses. Past enforcement has focused not just on big-name companies, but also smaller fry, so simply ignoring new or existing regimes can create significant regulatory risks. Furthermore, even if your organization doesn’t have the budget of, say, a large tech company, a privacy program can be built to scale. Small changes, such as ensuring that your privacy notice is reviewed regularly and is up to date with changing laws, or implementing vendor contracts, are relatively modest steps that go a long way toward achieving compliance.

Myth 4: Privacy is currently a hot legal trend, but it’s a fad that will disappear in a few years.

While the field of privacy law is fairly new, legal restrictions on how organizations can collect, use and share information have been around for nearly 50 years. Groups in highly regulated areas such as health care, finance, government, critical infrastructure and education have been dealing with sector-specific privacy approaches for decades. Even though the last few years have seen an influx of new laws—and consumer privacy seems to be at the forefront of many legislators’ minds—the need to comply with regulations will still exist in the years ahead even if the flurry of legislation eventually slows.

It can all seem exceedingly complicated. If your organization or client has no idea where to start addressing consumer privacy, here are four steps to help guide you.

1. Determine which laws apply to your organization.

Every state law has various thresholds that a firm must meet to be required to comply. Moreover, Europe’s GDPR has broad territorial scope and often applies to entities outside the European Economic Area. The U.S., meanwhile, has additional sector-specific laws as outlined above. Understanding which apply to your group will help you devise a compliant program.

2. Map your data.

Determine which types of data you collect from each category of individual with which your organization interacts (customers, vendors, employees, website visitors) and whether that information is ever shared with third parties. This will help you craft strategies for vendor management, handle rights requests from individuals pursuant to various legislation, develop proper privacy notices and obtain correct consent when applicable.

3. Educate critical stakeholders and empower people within your organization to “own” data privacy measures.

Organizational buy-in is key to achieving a functional and compliant privacy program. Companies greatly benefit when their employees understand the stakes and can assist with compliance. Having an internal point person or team to respond to privacy inquiries on behalf of the broader firm can make establishing and running a program less daunting.

4. Analyze current “notice and consent” mechanisms already in place and revise them as appropriate.

Most consumer privacy regimes are built according to a “notice and consent” model, meaning that an organization has an obligation to notify consumers how it collects, uses and shares data, then to obtain consent (either opt-in or opt-out). Companies should examine whether and when they currently provide notice to individuals from whom they collect data, and how they manage obtaining consent or respecting an individual’s choices regarding its data practices.

This generally means reviewing one’s privacy policy regularly, ensuring that it encompasses all information use, collection and sharing, and making sure internal procedures are in place to address the requirements of various privacy laws, including procedures for handling consumers’ requests to exercise their rights.

This evolving body of law can seem like an utterly complex series of new requirements but dispelling the most common myths to others in your organization, or to your clients, and then taking a few initial steps to address legal compliance can go far toward creating a robust privacy program.

Casey Waughn is an Associate at Armstrong Teasdale LLP. She helps clients navigate and comply with complex regulatory regimes, particularly in the data privacy, cybersecurity and white-collar spaces. As a data privacy practitioner, Waughn counsels clients to develop, implement and maintain practical privacy and data protection strategies to fit their organization’s needs.

Related Articles

New Sheriff in Town on ESG

by Patricia Brown Holmes

Various regulatory agencies within the Biden Administration are stepping up enforcement of corporate malfeasance in the ever-trendy ESG space.

ESG Enforcement in the Corporate Environment

Follow the Money

by Rachel F. Sifuentes

Women are the future of fintech—but in the here and now, they’re still being underserved in an industry otherwise marked by explosive growth. Here’s why that must change.

Women and the Future of Fintech

Announcing the 7th Annual Women in the Law Publication

by Best Lawyers

The 7th Annual Women in the Law publication is a celebration of all the female legal talent across the country, honoring every woman listed in The Best Lawyers in America and Best Lawyers: Ones to Watch in America.

Honoring Female Lawyers in the United States

Trending Top Five: Critical Corporate Components for 2022

by Justin Smulison

It’s no longer “business as usual” for most of Corporate America. With a growing list of challenges facing the legal and financial health of many companies, we talked to several major General Counsel about the biggest areas in which businesses should remain vigilant.

Corporate Advice From General Counsel

Current State of EU to U.S. Data Transfers

by Gregory Sirico

The Biden Administration and European Commission recently came to a principle political agreement concerning the ever-changing future of EU to U.S. data transfers.

New Framework for EU and U.S. Data Transfers

The Future of Litigation Is Changing for Female Solicitors in the U.K.

by Catherine Baksi

The support of entire law firms, organizations and senior counsel members will be the key to encouraging female solicitors and positive change in the industry.

Changing Litigation for UK Female Solicitors

The Upcycle Conundrum

by Karen Kreider Gaunt

Laudable or litigious? What you need to know about potential copyright and trademark infringement when repurposing products.

Repurposed Products and Copyright Infringemen

The Compensation Situation

by Liz S. Washko

Pay discrimination has been outlawed for decades. Yet the issue has taken on new salience in recent years. Here’s what to know about compensation equity—and where the legal risk lies for companies.

Pay Discrimination and Equity in Legal Indust

Remote Controls

by Cynthia Morgan Ohlenforst

How law firms, lawyers and taxing authorities must adapt to remote work

Law Firms Adapt to Remote Work

Changes and Challenges

by Megan Norris

As the pandemic ebbs and many people return to the office, midsize law firms in particular must navigate a host of unprecedented questions about costs, culture and client expectations.

Changes, Challenges and Cost of the Pandemic

Carrying the Torch While Raising the Bar

by Sharen L. Nocella

Catherine Pyune McEldowney makes waves as one of the few Asian-American women at the pinnacle of a U.S. law firm.

Asian-American Representation in Law

Forging Bonds, Building Business

by Crystal L. Howard and Lizl Leonardo

As disorienting and occasionally frightening as the pandemic has been, it has also forced lawyers to find innovative new ways to stay connected and do business.

Pandemic Sparks Innovative Ways of Conducting

We Are Women, We Are Fearless

by Deborah S. Chang and Justin Smulison

Athea Trial Lawyers is a female owned and operated law firm specializing in civil litigation, catastrophic energy, wrongful death and product liability.

Athea Trial Law Female Leadership and Success

Recent Developments on Privacy and Data Protection in Brazil

by Ricardo Barretto Ferreira da Silva and Camila Taliberti Ribeiro da Silva

A change of paradigm is urgent and requires a robust legislation on personal data protection.

Privacy and Data Protection Brazil

My Data My Rules: An Overview of Data Protection in Brazil

by Fábio Pereira

My Data My Rules

DOJ Probe of PGA Could End Very Differently than Earlier FTC Case

by John Ettorre

The PGA, golf’s most notable professional tournament tour, is facing steep competition on the course and possibly in the courts from LIV Golf, a new professional golf tour that promises some of the sport’s biggest winnings.

White flag with gold writing against blue sky

Trending Articles

The Real Camille: An Interview with Johnny Depp’s Lawyer Camille Vasquez

by Rebecca Blackwell

Camille Vasquez, a young lawyer at Brown Rudnick, sat down with Best Lawyers CEO Phillip Greer to talk about her distinguished career, recently being named partner and what comes next for her.

Camille Vasquez in office

Announcing the 2022 Best Lawyers® in the United States

by Best Lawyers

The results include an elite field of top lawyers listed in the 28th Edition of The Best Lawyers in America® and in the 2nd Edition of Best Lawyers: Ones to Watch in America for 2022.

2022 Best Lawyers Listings for United States

Famous Songs Unprotected by Copyright Could Mean Royalties for Some

by Michael B. Fein

A guide to navigating copyright claims on famous songs.

Can I Sing "Happy Birthday" in Public?

Best Lawyers: Ones to Watch – The Future of Legal Talent Looks Bright

by Justin Smulison

Best Lawyers: Ones to Watch is launching its second edition in the United States, and after talking with both a company leader and esteemed lawyers on the list, the importance of this prestigious list is evident.

Best Lawyers: Ones to Watch in America 2022

Johnny Depp and Amber Heard: The Best Lawyers Honorees Behind the Litigation

by Gregory Sirico

Best Lawyers takes a look at the recognized legal talent representing Johnny Depp and Amber Heard in their ongoing defamation trial.

Lawyers for Johnny Depp and Amber Heard

Why Cariola Díez Pérez-Cotapos Developed Its Own Legal Tech

by Best Lawyers

Juan Pablo Matus of Cariola Díez Pérez-Cotapos, 2019 "Law Firm of the Year" award for Corporate and M&A Law in Chile, discusses his firm's joint venture with Cognitiva in creating Lexnova, a legal AI system.

Cariola Díez Pérez-Cotapos Interview

Choosing a Title Company: What a Seller Should Expect

by Roy D. Oppenheim

When it comes to choosing a title company, how much power exactly does a seller have?

Choosing the Title Company As Seller

Announcing the 2022 "Best Law Firms" Rankings

by Best Lawyers

The 2022 “Best Law Firms” publication includes all “Law Firm of the Year” recipients, national and metro Tier 1 ranked firms and editorial from thought leaders in the legal industry.

The 2022 Best Law Firms Awards

Announcing the 2022 Best Lawyers in Canada™

by Best Lawyers

The results include an elite field of top lawyers listed in the 16th Edition of The Best Lawyers in Canada™ and 1st Edition of Best Lawyers: Ones to Watch in Canada.

Announcing the 2022 Best Lawyers in Canada™

Education by Trial: Cultivating Legal Expertise in the Courtroom

by Margo Pierce

The intricacies of complex lawsuits require extensive knowledge of the legal precedent. But they also demand a high level of skill in every discipline needed to succeed at trial, such as analyzing technical reports and deposing expert witnesses.

Cultivating Legal Expertise in the Courtroom

Announcing The Best Lawyers in France™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms from France.

Blue, white and red strips

Wage and Overtime Laws for Truck Drivers

by Greg Mansell

For truck drivers nationwide, underpayment and overtime violations are just the beginning of a long list of problems. Below we explore the wages you are entitled to but may not be receiving.

Truck Driver Wage and Overtime Laws in the US

Caffeine Overload and DUI Tests

by Daniel Taylor

While it might come as a surprise, the over-consumption of caffeine could trigger a false positive on a breathalyzer test.

Can Caffeine Cause You to Fail DUI Test?

Announcing the 2022 Best Lawyers™ in Australia

by Best Lawyers

The results include an elite field of top lawyers and firms.

Announcing the 2022 Best Lawyers™ in Australi

Announcing The Best Lawyers in Australia™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms from Australia.

The Best Lawyers in Australia™ 2023

Announcing The Best Lawyers in The United Kingdom™ 2023

by Best Lawyers

The results include an elite field of top lawyers and firms from the United Kingdom.

The Best Lawyers in The United Kingdom 2023