UPDATE ON NEW STATE CYBERSECURITY AND PRIVACY LAWS
January 21, 2022
In the coming year, it is expected that several states will enact or consider new laws related to data security, cybersecurity and privacy. Some states will have new bills that will go into effect in 2023 that generally incorporate the basic concepts regarding access, notice, restrictions on the sale of information and affirmative rights for consumers that originated with the EU’s General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act (the “CCPA”). For example, the CCPA (which was technically effective as of December 16, 2020) has several revising provisions that will become operative on January 1, 2023, which include (a) an expansion of existing consumer rights and a creation of four new consumer rights; (b) the creation of a new class of vendors and contractors with associated obligations; and (c) the establishment of the California Privacy Protection Agency which will have investigatory, enforcement, and rulemaking authority.
Similarly, New York is currently considering legislation to address privacy and cybersecurity issues including bills incorporating new obligations such as imposing fiduciary duties and impact assessments for automated decision-making. One such bill is the New York Privacy Act, which if passed would cover all companies that process the personal data of New York residents, create fiduciary duties of care, loyalty, and confidentiality, and create a private right of action for claimants asserting any violations of consumer rights.
For a more in depth review of cybersecurity and privacy issues to be aware of going into 2022, please see Eckert Seamans’ December 2021 Data Security & Privacy Alert, available here.
If you have any questions, please contact Evelyn Sahr (esahr@eckertseamans.com 202-659-6622) or Drew Derco (dderco@eckertseamans.com 202-659-6665).
Share This Post
Authors
