UPDATE ON CONSUMER PRIVACY LAW INITIATIVES
July 12, 2022
Since our last update, two more states have decided to enact comprehensive consumer privacy laws that will apply to any entities that collect or use the personal data of state residents. First, in March 2022, Utah adopted its comprehensive consumer privacy law known as the Utah Consumer Privacy Act (“UCPA”) which is set to go into effect on December 31, 2023. Utah’s law largely mirrors the GDPR, which is the European Union’s (“EU”) privacy law, and Virginia’s 2021 Consumer Data Protection Act by incorporating the same distinctions for “controllers” and “processors” that both laws include.
Looking further west, California’s new privacy regulator recently issued the first draft of the state’s highly anticipated regulations for a revamped consumer privacy law, the California Privacy Rights Act (“CPRA”), that is set to take effect in January 2023. Notably, under California’s current consumer privacy law and the CPRA, the penalty for violations is $2,500 per day for unintentional breaches to $7,500 per day for intentional breaches, and both the current law and the CPRA allow consumers a private right of action when there is a breach of their unencrypted and unredacted personal information, which allows for damages between $100 and $750 per incident or actual damages, whichever is greater.
Lastly and more recently, the Governor of Connecticut signed into law Connecticut’s comprehensive consumer privacy act called the “Act Concerning Personal Data Privacy and Online Monitoring” (or “CTDPA”) effectively making Connecticut the fifth and most recent state in the U.S. to enact a comprehensive consumer privacy law. The CTDPA goes into effect on July 1, 2023 and incorporates many of the same tenets regarding “controllers” and “processors” of personal data as found in the GDPR and previously enacted privacy laws in other states.
All of the laws define “personal data” as information that is linked to or reasonably linkable to an identified individual or identifiable individual and create a category of “sensitive data” that includes personal data that reveals an individual’s racial or ethnic origin, citizenship or immigration status, sexual orientation, religious beliefs, and information regarding an individual’s medical history including diagnoses, treatments, or mental and/or physical health conditions. The enactment of these most recent consumer privacy laws is a part of a continuing trend across the U.S. It is important to note that these laws are applicable to many airlines as they often apply to both organizations and entities that determine the means and purposes of processing personal data, known as “controllers,” as well as other organizations and entities that process personal data on the controllers’ behalf, known as “processors,” and include requirements that such organizations and entities must follow. For example, if an airline currently uses or collects the personal data from residents of any of the five states enacting consumer privacy laws in 2023, then the air carrier would be obligated to comply with the relevant state’s law and the duties that are imposed under the new laws which include for example, pre-collection disclosures about the use and sharing of data, opt-outs from sales of data, and responding to consumer information requests.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com 202-659-6622), Drew Derco (dderco@eckertseamans.com 202-659-6665).
*Editor’s Note: We would like to give special thanks to Summer Intern, Thiseas Efthymiou for his contributions to this month’s posts.
Share This Post
Authors
