State Privacy Laws Flashcards
Illinois Biometric Info Privacy Act (BIPA)
passed in 2008
most high profile biometric privacy law
applies to
1. biometric identifiers- retina or iris scan, fingerprint, voiceprint, or record of hand or face geometry
2. biometric info- info based on individuals biometric identifier and used to identify individual
BIPA requirements
- must give notice to individual prior to processing info (include length of time it will be collected/stored before processing biometric identifiers or biometric info)
- obtain written release from data subject before collection
- no sale of biometric data
- disclose only in limited situations
- meet requirements for storage + publicly available policy for retention
BIPA enforcement
private cause of action
Texas Capture or Use of Biometric Identifier Act (CUBI)
- need consent to
- capture biometric identifier of individual for commercial purposes
- sell, lease, or disclose that biometric identifier to 3rd party - use reasonable care in storing data
- destroy data no later than 1 year after purpose for collecting identifier expires
CUBI enforcement
TX attorney general
Washington Biometric Privacy Law
passed in 2017
company may not enroll biometric identifier into database for commercial purposes unless
1. adequate notice provided +
2. consent received +
3. mechanism is put in place to prevent subsequent use of info for commercial purposes
Virginia Consumer Data protection Act (VCDPA)
2nd state to implement comprehensive privacy legislation (behind CA)
applies to
1a. any person conducting business in VA
1b. any person that produces products/services targeted at VA residences
+
2a. processes personal data of at least 100,000 consumers or
2b. controls/processes personal data of at least 25,000 consumers and derives over 50% of gross revenue from sale of personal data
no revenue threshold (different from CCPA)
doesn’t apply to
- organizations subject to GLBA or HIPAA
- nonprofits
- higher education institutions
VCDPA consumer rights
- access
- confirmation whether processing their data
- amend
- delete
- obtain copy
- opt out
VCDPA enforcement
VA attorney general
Colorado Privacy Act (CPA)
3rd state to enact comprehensive privacy legislation
applies to
1a. persons that conduct business in CO or
1b. persons that produce/deliver commercial products/services intentionally targeted at CO residents
+
2a. control/process data of 100,000 consumers or more during 1 year
2b. sell personal data and process/control data of 25,000 consumers
doesn’t apply to
- organizations subject to HIPAA, GLBA< COPPA, FERPA etc
- data maintained for employment records purposes
APPLIES TO NONPROFITS
CPA controller responsibilities
- transparency (privacy notifications)
- purpose specification
- data minimization (only what is reasonably necessary)
- care
- avoid unlawful discrimination
- consent
- safeguards
- processor contracts (processor must adhere to controller instructions and can’t engage in subcontracts unless controller opt to object)
CPA data subject rights
- access
- amend
- delete
- opt out
- appeal action on requests to exercise rights
CPA enforcemen
CO attorney general and local district attorneys
Nevada Privacy Act
applies to personally identifiable info obtained from internet or online service maintained by operator of website or data broker
doesn’t apply to
1. CRA
2. processing for fraud prevention
3. personal data publicly available
4. data regulated by DPPA or GLBA or FCRA
Nevada Privacy Act requirements
must provide online privacy notice
operators and data brokers must establish designated request address
Nevada Privacy Act
NV attorney general
Connecticut Data Privacy Act
applies to
1. any business operating in Connecticut
1b. any business targeting goods/services to CT residents
+
2a. process personal data of at least 100,000 consumers or
2b. process personal data of 25,000 consumers and derive over 25% of its gross revenue from sale of personal data
doesn’t apply to
1. personal data deidentified or publicly available
2. processing done solely for payment transactions
Connecticut Data Privacy Act data subject rights
- access
- correct
- delete
- data protability
- opt out
Connecticut Data Privacy Act enforcement
CT attorney general
Utah Consumer Privacy Act
controllers or processors that
1. conduct business in Utah or target consumer in UT
2. have annual revenue of 25 million (revenue threshold)
3. either
- process personal data of 100,000 or more consumers or
- process personal data of 25,000 and derive 50% of gross revenue from sale of personal data
doesn’t apply to aggregated data (relates to group or category of consumers which individual identification is removed)
UDPA rights of data subject
- delete
- opt out
no right to correct inaccurate data
UDPA enforcement
UT attorney general
division of consumer protection administers system to receive consumer complaints and refers matter to AG if believe violation exists
Iowa Consumer Data protection Act (ICDPA)
6th state to enact comprehensive privacy legislation
effective in 2025
applies to
1. entities that conduct business or target consumers in Iowa
2. process or control data
- data of 100,000 IA consumers or
- personal data of at least 25,000 IA consumers and derive more than 50% of their gross revenue from selling personal data
ICDPA data subject rights
- notice
- opt out
- access
- obtain copy
- delete
no right to correct data or opt out of profiling or automated decision making
no assessments needed to be made by businesses
ICDPA enforcement
IA attorney general
Delaware Online Personal Privacy Protection Act (DOPPA)
broader than COPPA
applies to children under age of 18 (not under 13 as in COPPA)
prohibits advertising related to tobacco, firearms, tanning equipment, etc towards children
requires privacy policy notice posted on website that collect personal information
Illinois Student Online Personal Protection Act (SOPPA)
most comprehensive state level privacy legislation applicable to student records or education industry
applies to covered info - personally identifiable info that is not publicly available dn is created by or provided to operator of education tech service by student, parent or school
SOPPA- operator of education services requirements
- no
- targeted ads
- profiling of students
- selling student data or
- disclosing covered info - implement reasonable security practices
- delete info within reasonable time or upon request
- privacy notice
- written contracts with schools before receive covered info
- notify school of any breach of students covered info
- provide schools list of 3rd party vendors covered info is shared with
SOPPA- schools requirements
- no selling or disclosing covered info unless to parent or school board member
- make expansive disclosures about personal info collected, data breaches, that are posted on school website
- implement reasonable security procedures
- designate school privacy officer
SOPPA- state board of education
- no selling or disclosing student data
- must public data about vendors and covered info it maintained
- develop model student data privacy policy and procedure
data breach notification laws
all 50 states have data breach notification laws (no federal law)
