720-891-1663
Return to list of client alerts
Here is the short version. There are now 8 states and 9 laws that cover what we are calling second-generation privacy laws. The difference between first-generation and second-generation laws is that second-generation laws give consumers new rights such as the right to get a copy of the data that a company has collected or the right to correct errors.
As of the end of 2022, there were 5 states and 6 laws with second-generation privacy laws:
Note that these include red and blue states.
Earlier this year Iowa became the 6th state to join the club.
This week, two more were added to the list – Montana and Tennessee.
The challenge for businesses that want to comply different state laws is that the laws have different and sometimes contradictory requirements.
Also, while there are legal exemptions for some companies, such as those that are regulated by other regulatory bodies such as HHS for HIPAA and the FTC and SEC for GLBA and, in some cases, for small businesses, businesses need to consider what consumers are going to expect.
If a consumer lives in one of these states and sends you a letter asking for a copy of their data and you respond saying “thank you for letter, but we fit under one of the exemptions, so we are not going to respond to your request.
Consider they might, possibly, post that fact, along with some choice words added, to social media.
How much is a negative review on Facebook, Truth Social, Twitter or other social media. We strongly urge businesses to consider the negative PR factor before taking the “nuclear” option.
Also, for folks regulated by GLBA, the new Safeguards Rule requires you to do a lot of the same work that the new privacy laws require, so it is not exactly a get out of jail free card.
Finally, there are still at least a half dozen states with bills in the hopper including Hawaii, Indiana, New Hamshire, Oklahoma, Texas and New York (which has 9 separate bills).
Credit: Truyo