USA – WASHINGTON Trends and Developments Contributed by: Amy Weston, Eva Novick, Brian Esler and Lauren Fricke, Miller Nash LLP
know of the risk and should implement correspond - ingly greater security measures. Class action lawyers are also becoming more creative in the claims they plead, evolving from mere negligence allegations to claims of breach of contract, breach of fiduciary duty, and violations of Washington’s CPA, which allows for recovery of fees and treble damages. Furthermore, Washington businesses need to be mindful of privacy class actions that have been sweeping across the country. For example, Wash - ington businesses that do not do business with con - sumers in other states or only operate business to business (B2B) may still be served with a complaint alleging various state and federal theories, such as under the California Invasion of Privacy Act (CIPA), the Electronic Communications Privacy Act (ECPA) and the Video Privacy Protection Act (VPPA). Busi - nesses should also continue to monitor laws enacted in other states, such as Maryland’s new Online Data Privacy Act (MODPA), which requires businesses of a certain size to obtain explicit consent from individu - als before collecting or sharing their precise location information. Designed to prevent unauthorised track - ing or surveillance, MODPA encompasses information obtained from GPS, Wi-Fi, Bluetooth, cellular tower triangulation or similar technologies. MODPA’s geolo - cation restrictions mirror the geofencing limitations in the MHMDA, and businesses can and should expect Washington courts and regulators to take note of how MODPA is enforced and interpreted in Maryland. While there is currently no Washington law involving children’s data or requirements of age-appropriate website or app design, businesses can expect a greater focus on children’s privacy under other state and potentially federal legal initiatives. Similarly, Wash - ington businesses will face challenges and risks when handling personal data of non-Washington residents, as the patchwork collection of state comprehensive and sector-specific privacy laws continues to grow. Washington businesses can protect themselves by having an updated and accurate website privacy notice, obtaining consent through a cookie banner that is properly operating, avoiding dark patterns, tightening their vendor contracts, and continuously monitoring their security protocols so as to have an
auditable paper trail of best practices should data thieves strike and class action lawyers follow. Top Compliance Challenges for Businesses Moving beyond understanding the law, the practical task of compliance presents several consistent chal - lenges. First is the mapping and inventory dilemma. Many organisations still lack a clear, real-time pic - ture of what data they collect, where it flows and with whom it is shared. This foundational gap makes complying with access, deletion and opt-out requests operationally impossible. Secondly, the vendor management life cycle has become a high-stakes compliance area. The old prac - tice of signing a vendor’s standard data agreement is now a major liability. Businesses must actively manage their third-party relationship with ongoing diligence and enforceable contractual protections that match regulatory duties. In addition to verifying that vendors do not share, sell or otherwise use customer data or personal information for their own purposes, busi - nesses must grapple with the risk of vendors using business data to train AI tools. Contractual restric - tions, even if legally enforceable against the vendor, may not offer a satisfactory defence if a customer’s data is leaked or otherwise disclosed due to a ven - dor’s failure to follow its own promises. Businesses should take steps to assess their vendors’ cyberse - curity and privacy compliance systems, and should reserve the right to audit a vendor’s tools to ensure that their promises match what their contracts say. Finally, incident response preparedness has shifted. The legal standard is no longer just about notifying authorities after a breach. Regulators and plaintiffs examine the reasonableness of data security practic - es before the incident. Documented privacy impact assessments, regular employee training, and encryp - tion standards are scrutinised to determine whether negligence occurred. What was considered “reason - able” five or ten years ago is no longer reasonable; data security practices must be regularly reviewed and updated to take into account changing technolo - gies and risk vectors.
631 CHAMBERS.COM
Powered by FlippingBook