United We Stand, Divided We Regulate Privacy?
Legal Implication of Privacy Regulation
Not exactly the way the well-known phrase goes of course but that seems to be what’s going on in the world of privacy regulation. California led the pack post GDPR with the CCPA, then Nevada came up with its SB220. Maine has passed LD 946, the Act to Protect the Privacy of Online Customer Information, which will take effect in 2020 and New York is looking at its own privacy regulation, the New York Privacy Act. Who’s next is anyone’s guess. Below are a few notable differences…
The CCPA applies to any business that is a for-profit entity, collects or controls any information about a California resident, and meets any one of the following criteria: you hold personal information about 50,000 or more people, households or devices, you earn half or more of your revenue from selling such information, and your gross revenue is $25 million or more. California also provides certain rights to California residents such as knowing what information is being collected and being able to stop the companies from selling that information.
Nevada’s Senate Bill 220
Takes effect October 2019. The new law made two big changes to the existing law : a requirement that businesses provide an online mechanism (or toll-free phone number) that permits consumers to opt-out of the “sale” of their personal information and the exclusion of financial institutions subject to Gramm-Leach-Bliley, entities subject to HIPAA and other industries.
Maine
Requires internet service providers to obtain an opt-in consent (rather than an opt out) before an ISP can begin “using, disclosing, selling or permitting access to [a consumer’s] prohibited personal information.” The definition of personal information is broad (similar to the GDPR) and includes geo-location and browsing information. It also contains a non-discrimination provision to prevent ISP’s from charging a fee based on a consumer’s choice.
New York’s
Proposes opt-in consent before companies can consumers’ personal data, with a similar broad take on the definition of personal information as Maine. Consumers can also obtain information about what data companies have collected about them, who else it’s shared with, and can ask for it to be deleted or corrected. New York’s law applies to companies of all sizes and revenues.
Why It Matters
The utter chaos of a possible state by state approach has caused the ad industry as a whole to really hone in on the push for a national privacy law. The more individual states who come out with individual and individualized policies, the more work advertisers will have to do not only to reach customers, but to figure out ways to reach them without breaking fifty sets of rules.