Page 10 - September-October-2022-CBA-Report

As ExpEctEd:
Consumer Privacy Legal Landscape Sees More Significant SI hifts in 2022
10
THE REPORT | September/October 2022 | CincyBar.org
n the absence of any progress at the federal level, states have taken action on their own with the introduction of proposed consumer privacy legislation geared toward placing greater
protections over consumers’ sensitive personal data. As discussed in the March/April 2022 CBA Report, 2021 brought several notable developments in the area of consumer privacy that significantly impacted how businesses collect and use personal data as part of their operations, including the enactment of two new consumer privacy statutes by Virginia and Colorado. As we entered 2022, the question on everyone’s minds was: Will we see more changes to the privacy legal landscape in 2022?
We now know the clear answer to that question is a resounding yes. State legislatures did not disappoint in their level of activity this year, with Utah and Connecticut both enacting comprehensive consumer privacy laws during the 2022 legisla- tive cycle—bringing the total number of states with consumer privacy statutes on the books to five. In so doing, these additional laws not only enhance the level of control consumers now possess over their sensitive personal data, they also significantly raise the level of complexity in terms of the challenge presented to busi- nesses needing to comply with a quickly-proliferating patchwork of laws, each slightly different than the next.
Ultimately, with 2022’s second wave of new consumer privacy laws—and with additional states likely to pass similar legislation of their own in the near future—companies should immediately begin making preparations to ensure compliance with the range of new privacy requirements and restrictions that will take effect starting at the beginning of 2023. At the same time, companies should build out their compliance programs with flexibility and adaptability in mind, such that only minimal program modifica- tions will be needed when additional laws are inevitably enacted in other parts of the country—sooner than later.
By David J. Oberly
Background: Key Prior Privacy Developments
In 2016, lawmakers in California enacted the game-changing California Consumer Privacy Act of 2018 (“CCPA”), which fundamentally altered the way companies across the country conduct business as a result of the expansive set of new privacy rights afforded to consumers under the law, as well as the corre- sponding set of new, stringent obligations imposed on businesses that collect and process their personal data.
At the end of 2020, California scrapped the CCPA and replaced it with its “CCPA 2.0”— the California Privacy Rights Act of 2020 (“CPRA”)—which significantly amends and supplements the CCPA by both strengthening consumers’ rights and increasing businesses’ compliance obligations. In March 2021, Virginia became the second state to put in place a robust consumer privacy law, with its enactment of the Virginia Consumer Data Protection Act (“VCDPA”). Shortly thereafter, Colorado followed up with the enactment of its Colorado Privacy Act (“CPA”).
Major 2022 Developments
2022 was no different in terms of the level of activity on the consumer privacy legislative front. In April, Utah added another wrinkle in the consumer privacy legal landscape with the enact- ment of its Utah Consumer Privacy Act (“UCPA”). A month later, Connecticut lawmakers enacted Public Act No. 22-15, “An Act Concerning Personal Data Privacy and Online Monitoring”— more commonly referred to as the Connecticut Privacy Act (“CTPA”)—making Connecticut the fifth state to enact a compre- hensive consumer privacy statute modeled after the CCPA and the second in 2022.