How do business owners keep track of all the relevant privacy laws – let alone comply with them?
Over the past few years, navigating the laws governing online privacy has gotten exponentially more complicated. The infamous GDPR applies to any site with users who are residents of the European Union – even if the site is based in the United States. Similarly, multiple US states have enacted laws that protect their citizens, and more are likely to follow suit. It’s critical that your business has a properly-drafted Privacy Policy, but also that your infrastructure is set up to comply with the relevant laws (for example, to delete personal data of a user on request). We can help determine which laws apply to your business, then help you get compliant on both the legal and operations side.
In today’s digital age, businesses have access to a wealth of data about their customers. While collecting personal data can be invaluable for improving services and tailoring marketing efforts, it also comes with significant risks and legal obligations.
In countries around the world – most notably the United States and the European Union – regulations have been put in place to protect individuals’ privacy and ensure the responsible handling of their data. This article explores the risks of collecting personal data from customers and the laws that apply in the US and EU. Other countries and territories have their own laws and regulations, so be sure to consult with a qualified attorney before collecting any personal data from your customers.
The Risks of Collecting Personal Data
- Data breaches: One of the most significant risks associated with collecting personal data is the potential for data breaches. These breaches can lead to the exposure of sensitive customer information, resulting in financial losses, reputational damage, and legal consequences for the company.
- Privacy concerns: Customers are increasingly concerned about their privacy. Collecting too much data without clear consent or a valid reason can erode trust and lead to customer attrition.
- Regulatory fines: Non-compliance with data protection regulations can lead to hefty fines. In some cases, these fines can be significant enough to threaten the financial stability of a business.
Data Protection Laws in the United States
Several states in the US have enacted consumer privacy laws – with more on the horizon. At the time of this writing, California’s privacy law is commonly considered the strictest US privacy law, so complying with that law will usually put business owners in good shape in other states as well. Below is a summary of California’s privacy requirements.
California Consumer Privacy Act (CCPA)
This state-level regulation grants California residents more control over their personal data. Companies that collect data from Californian customers must provide clear privacy notices and the option for customers to opt out of data collection.
The CCPA is one of the most comprehensive data privacy laws in the US and plays a significant role in safeguarding the privacy of California residents. Here’s a summary of the key points of the CCPA:
- Scope: The CCPA applies to certain businesses that collect, sell, or share the personal information of California consumers. It covers both online and offline data collection and applies to businesses that meet certain revenue or data processing thresholds.
- Consumer rights: The CCPA grants California residents a number of rights over their personal data, including the right to know what data is being collected and how it’s used. Consumers have the right to access their personal information, request deletion of data, and opt-out of the sale of their data.
- Opt-out of data sale: Businesses are required to provide a clear and conspicuous “Do Not Sell My Personal Information” link on their websites, allowing consumers to opt-out of the sale of their data.
- Data protection assessments: Businesses must conduct data protection impact assessments, evaluating the risks and benefits of their data processing activities.
- Data breach notification: In the event of a data breach, businesses are required to notify affected consumers and the California Attorney General.
- Non-discrimination: Businesses cannot discriminate against consumers who exercise their CCPA rights, such as providing a different level of service or charging higher prices.
- Children’s privacy: The CCPA includes specific provisions to protect the privacy of children under the age of 16. For children under 13, parental consent is required.
- Enforcement and penalties: The California Attorney General is responsible for enforcing the CCPA, and consumers have the right to bring private actions in certain circumstances. Non-compliance can result in significant fines, with penalties of up to $7,500 per violation.
- Future amendments: The CCPA continues to evolve, and amendments are periodically made to clarify and expand its provisions.
It’s essential for businesses to be aware of and compliant with the CCPA’s requirements. The CCPA aims to give consumers more control over their personal data and holds businesses accountable for their data handling practices. Complying with the CCPA not only helps businesses avoid penalties but also builds trust with customers who are increasingly concerned about their privacy in the digital age.
Health Insurance Portability and Accountability Act (HIPAA)
HIPAA provides data privacy and security provisions for safeguarding medical information in the US.
The act has two main purposes:
- Portability: To maintain health insurance coverage for individuals who change or lose their jobs, thereby reducing healthcare fraud and abuse.
- Accountability: To establish a need for health care organizations to comply with standards for electronic health care transactions and codes sets, unique health identifiers, and security.
At its core, HIPAA consists of several key rules:
- Privacy rule: Establishes national standards to protect individuals’ medical records and other personal health information.
- Security rule: Sets standards for the security of electronic protected health information (ePHI).
- Transaction and code sets rule: Requires the standardization of electronic data interchange in health care transactions.
- Unique identifiers rule: Mandates that health care providers have a national provider identifier (NPI).
HIPAA compliance is enforced by the Office for Civil Rights (OCR) and covers “covered entities” (e.g., health plans, health care clearinghouses, and most health care providers) and “business associates” (entities that perform certain functions that involve the use or disclosure of protected health information on behalf of, or services to, the covered entity).
Violations of HIPAA can result in significant financial penalties, leading to a strong incentive for compliance among health care entities and associated businesses.
Children’s Online Privacy Protection Act (COPPA)
COPPA protects the privacy of children under the age of 13 when they are engaging with digital services such as websites, apps, and online games.
Key elements of COPPA include:
- Parental consent: Before collecting, using, or disclosing personal information from children, operators of websites or online services must obtain verifiable consent from parents or guardians.
- Notice: Websites and online services must provide a clear and comprehensive privacy policy describing their information practices for children’s data.
- Information practices: COPPA puts restrictions on how website operators can collect and handle children’s personal information, with strict rules on confidentiality, security, and retention of the data.
- Access: Parents must be allowed to review the personal information collected from their children and have the option to revoke consent and request that the information be deleted.
- Prohibition on conditioning participation: Websites and online services cannot condition a child’s participation in games, the offering of prizes, or another activity on the child providing more personal information than is reasonably necessary.
The law is enforced by the Federal Trade Commission (FTC), which has the authority to issue regulations and enforcement actions including fines for non-compliance.
COPPA compliance is crucial for any online service that is either directed towards children under 13 or knowingly collects information from children in this age group. Failing to comply with COPPA can result in substantial legal penalties and fines.
Data Protection Laws in the European Union
Many companies based in the US don’t realize that they may need to be compliant with overseas privacy regulations as well. In many countries, privacy laws apply if a resident of that country accesses a website – regardless of where the company that operates the website is located.
General Data Protection Regulation (GDPR)
The most well-known – and, for many US companies, the most important – example of such a law is GDPR. This law is a comprehensive regulation that applies to all EU member states. It enforces strict rules on obtaining consent, data protection impact assessments, and the right to be forgotten.
Some of GDPR’s requirements include:
- Consent: For data processing to be lawful, consent must be freely given, specific, informed, and unambiguous. It must be as easy to withdraw consent as it is to give it.
- Rights of data subjects: GDPR grants individuals several important rights, including:
- The right to access their personal data.
- The right to have errors in their data corrected (rectification).
- The right to have their data erased (the right to be forgotten).
- The right to restrict processing of their data.
- The right to data portability.
- The right to object to data processing.
- Data Protection Impact Assessment (DPIA): Organizations must conduct a Data Protection Impact Assessment for processing that is likely to result in high risk to the data subjects’ rights and freedoms, particularly using new technologies.
- Data Protection Officers (DPO): Organizations must appoint a Data Protection Officer if they engage in large-scale systematic monitoring or processing of sensitive personal data.
- Breach notification: In the event of a data breach, organizations must notify the appropriate data protection authority within 72 hours. Affected individuals must also be notified if the breach could result in a high risk to their rights and freedoms.
- Cross-border data transfers: GDPR restricts data transfers to non-EU countries that do not provide an adequate level of data protection. Such transfers require appropriate safeguards.
- Accountability: The regulation requires organizations to demonstrate compliance with its principles. This includes maintaining detailed records of data processing activities, ensuring data security, and implementing data protection policies.
GDPR applies not only to organizations based within the EU but also to those outside the EU if they offer goods or services to, or monitor the behavior of, individuals located in the EU. Non-compliance can lead to significant penalties, including fines of up to 4% of annual global turnover or €20 million (whichever is greater).
Next Steps
No matter what your company’s industry or size, privacy concerns are likely to be one of its biggest potential liabilities. Book an exploratory call with us to help limit your exposure.
