Data privacy

The new coronavirus has forced many state legislatures to suspend their sessions or shift focus away from anticipated data privacy legislation.

"There was a significant tide of activity in many states," Glenn Brown, of counsel at Squire Patton Boggs in Atlanta, said.

New Jersey, for example, has the New Jersey Disclosure and Accountability Transparency Act floating through the Legislature, which would require a business to get consent from consumers before selling their personal data. Nevada lawmakers introduced a similar bill in February 2019, SB 220, which would prohibit the operator of a website or online service from selling consumer information if the consumer opts out of the sale of that information.

Experts say the California Consumer Privacy Act is what in-house counsel and their companies should be focusing on to prepare for what lies ahead at the state level when the pandemic is over.

"In the online space, any given state law can easily become a de facto national standard," Jim Shreve, a partner at Thompson Coburn in Chicago, said.

The CCPA requires that companies that do business in California allow consumers to opt into the collection and sale of data and provides for a private right of action over data breaches. The law applies to any company that does business in California and has personal information of a California resident. Enforcement for the CCPA is slated to begin in July despite calls from trade organizations to push the enforcement date to 2021 because of COVID-19.

"Failure to comply will be investigated and enforced. Since that is the case, it behooves companies to focus on compliance and will put them in a better position when other bills are signed into law," Brown said.

Jean-Marc Chanoine, global head of strategic accounts and legal counsel at Templafy in New York, said the CCPA can act as a good template for companies going forward.

"What you're going to find is state legislatures are going to take the CCPA and edit it. Some parts of that may become stricter and you have to be able to think ahead," Chanoine said. "You have to be able to think ahead and get the right stuff in place."

Chanoine said that since many global organizations already have remote capabilities, they should be able to prepare for data privacy laws remotely without much trouble.

What Could Be Added

In the realm of cybersecurity and data privacy, lawmakers may also have their eyes on issues that have emerged from the pandemic. Shreve said he would expect lawmakers to look at how companies are using geolocation.

"In response to the pandemic, some people have urged the geolocation tracking of those who have COVID-19. This creates potential privacy issues and state legislatures may again seek to regulate the collection and use of location data," Shreve said.

He also said lawmakers may begin looking at online services that companies are using, especially meeting applications such as Zoom, where privacy issues have arisen during the course of the pandemic.

"That can put employers and companies in a difficult position," Shreve said. "The company may not be aware that the service provider has access to their data and is not able to scrutinize them."

Shreve said he would expect states to legislate those online service providers directly rather than legislate how companies use those services.