USA Law and Practice Contributed by: Aly Dossa and Marcus Burnside, Chamberlain Hrdlicka
• California’s Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA); • Virginia’s Consumer Data Protection Act (VCPA); • Colorado Privacy Act; • Connecticut Data Privacy Act; and • Utah Consumer Privacy Act. These laws generally share common features including consumer rights (access, deletion, correction, port - ability), business obligations (transparency, purpose limitation, data security) and opt-out rights for certain data uses, but differ significantly in their thresholds for applicability, definitions, exemptions, private rights of action and enforcement authority. Between 30–35 states have enacted more limited sec - toral privacy laws addressing specific technologies or data types, such as biometric data, genetic informa - tion, insurance data or financial data. In addition, many states have older laws that did not contemplate data collection but are now being applied to data collection practices. The most notable type of these laws is recording consent laws that were origi - nally intended to apply to the recording of phone calls, but have now been applied to online interactions, and most notably to data collection on websites. Interaction Between Federal and State Laws Federal sectoral laws generally pre-empt conflicting state laws within their specific domains. For exam - ple, HIPAA pre-empts state health privacy laws that provide less stringent protections but allows states to maintain more protective standards. GLBA similarly pre-empts state financial privacy laws to a significant extent. State comprehensive privacy laws typically contain exemptions for data and entities already regulated under federal sectoral laws, creating a complex patch - work where different rules apply depending on the type of data, the entity collecting it, the context of col - lection and the use of the data. Organisations handling multiple data types must comply with overlapping fed - eral sectoral requirements, state comprehensive laws and additional state-specific sectoral requirements.
This fragmented approach creates significant com - pliance complexity, as organisations must navigate which law applies to which data processing activity, with potential gaps where certain data or activities fall outside all regulatory frameworks. Extraterritorial Reach Several state privacy laws have extraterritorial appli - cation. California’s CCPA/CPRA applies to businesses that collect personal information of California resi - dents, regardless of where the business is located, if the business meets certain revenue or data process - ing thresholds. Similarly, Virginia, Colorado, Connecti - cut and other states apply their laws to controllers and processors that conduct business in the state or pro - duce products or services targeted to state residents. These extraterritorial provisions are triggered by fac - tors such as targeting residents of the state, con - ducting business in the state or meeting quantitative thresholds related to the number of residents whose data is processed. The various state laws use differ - ent threshold tests, creating additional complexity for multi-state operations. Federal sectoral laws generally apply based on the nature of the regulated entity or activity rather than geographic considerations, though they apply throughout US jurisdictions. Interplay With Non-Personal Data, Cybersecurity and AI Regulation Cybersecurity The distinction between privacy and cybersecurity regulation is often blurred. All 50 states have enacted data breach notification laws with varying requirements for timing, content and triggers. Federal sectoral laws like HIPAA and GLBA include security requirements alongside privacy provisions. The Cybersecurity and Infrastructure Security Agency (CISA) plays a role in critical infrastructure protection, which also have additional cybersecurity requirements. Several states have enacted cybersecurity frameworks requiring reasonable security measures, with some specifically addressing ransomware and incident response.
546 CHAMBERS.COM
Powered by FlippingBook