Page 10 - March-April-CBA-Report

More Changes Coming to the Privacy Legal Landscape?
What to Expect in 2022
10
THE REPORT | March/April 2022 | CincyBar.org
The myriad of new and innovative ways personal data is being leveraged for commercial purposes continues to proliferate. The associated legal risks are also rising as lawmakers seek to strengthen requirements placed on businesses’ data collection and processing practices.
2021 brought with it many noteworthy developments in consumer privacy that significantly impacted businesses that collect and use personal data as part of their operations, including the enactment of two new consumer privacy statutes by Virginia and Colorado. In 2022, businesses should expect more of the same, with the passage of additional consumer privacy laws that will create significantly enhanced, more complex compliance obli- gations as compared to years past.
From a broader perspective, as the breadth of legal expo- sure stemming from the use of personal data continues to trend upward, Ohio businesses that utilize consumer data—even those that are not subject to any consumer privacy laws currently—are well-advised to ensure they have the proper policies, procedures, and practices in place to minimize the ever-increasing risk stem- ming from greater consumer privacy regulation.
2021 in Review
2021 was a busy year on the consumer privacy front. Last March, Virginia became the second state to enact a compre- hensive consumer privacy statute modeled after the California Consumer Privacy Act of 2018 (“CCPA”). Known as the Virginia Consumer Data Protection Act (“VCDPA”), the law will take
By David J. Oberly
effect at the start of 2023. Colorado also passed similar consumer privacy legislation, the Colorado Privacy Act (“CPA”), which will go into effect on July 1, 2023. In addition, California’s “CCPA 2.0,” the California Privacy Rights Act (“CPRA”)—which amends and supplements the CCPA, enhancing consumer rights and busi- nesses’ compliance obligations—will also go into effect at the start of next year as well.
The VCDPA and CPA are similar in many respects to their California counterparts, providing a range of new rights to consumers while also imposing obligations on businesses that collect and use their personal data. Significantly, neither law includes a private right of action; instead, enforcement rests solely with those states’ attorneys general.
At the federal level—as has been the trend for years now— Congress failed to pass any meaningful consumer privacy regulatory framework that would apply uniformly across all 50 states.
What to Expect in 2022
In 2022, new state consumer privacy laws will likely be added to the mix, creating an even more complex patchwork of compli- ance requirements for businesses that collect and use consumers’ sensitive data.
Already this year, Florida, Hawaii, Indiana, Kentucky, Mary- land, Mississippi, Missouri, Nebraska, New Hampshire, New Jersey, Oklahoma, Pennsylvania, Vermont, and Washington have introduced comprehensive consumer privacy legislation modeled after the CCPA, CPRA, VCDPA, and CPA.