22/02/2024
Understanding US Privacy Laws
It is important to recognize that in the US, privacy laws are still relatively new and as such are continuing to evolve. Privacy law in the US is typically fragmented with no single unitary body of law like the Data Protection Directive in the European Union. Instead, US privacy law is made up of a complex patchwork of federal and state laws and regulations that are developing and changing rapidly. This, combined with the fact that enforcement of US privacy laws is generally increasing, means that businesses need to take the legal requirement to protect personal information very seriously. In particular, legal requirements for US businesses are gaining strength in two key ways. First, many states are introducing comprehensive privacy statutes like the California Consumer Privacy Act of 2018 whose protections are similar to those in the European Union. Second, many states are also introducing laws requiring companies to improve their data security practices. For example, many have introduced laws incorporating the National Institute of Standards and Technology's Cybersecurity Framework. By setting out a risk-based approach to data security and referencing specific cybersecurity standards and guidelines, these laws mean that businesses must take a more proactive approach to data security than ever before. This is especially true in light of the fact that breaches are becoming more and more common, following the trend that we discussed earlier. For example, between January and September 2018, there were 850 publicly disclosed data breaches. Businesses that need to comply with these laws but fail to do so will be subject to serious penalties and fines. Penalties can include monetary fines based on the number of affected records, damage actions brought by individuals whose personal information has been accessed due to a data breach, and injunctions by the state attorney general. Therefore, failing to comply with US privacy laws will mean a business in question is at risk of significant financial and reputational loss.
Reach out to us if you need to check whether your business is compliant with required Privacy laws. If an organization does not have an adequate and fully compliant privacy policy, it is liable to face Federal Trade Commission enforcement action. This means that your Company can be sued by the FTC either federally or before an administrative judge. Damages awarded in these cases should not be underestimated. REad more in the attached brief.