{"id":209079,"date":"2023-05-12T12:30:00","date_gmt":"2023-05-12T19:30:00","guid":{"rendered":"https:\/\/sharethis.com\/?p=209079"},"modified":"2023-09-01T10:49:40","modified_gmt":"2023-09-01T17:49:40","slug":"the-rapidly-changing-future-of-data-privacy-and-how-to-prepare-for-it","status":"publish","type":"post","link":"http:\/\/sharethis.com\/data-topics\/2023\/05\/the-rapidly-changing-future-of-data-privacy-and-how-to-prepare-for-it\/","title":{"rendered":"The Rapidly Changing Future of Data Privacy and How to Prepare for It"},"content":{"rendered":"
<\/div>\n

If the current state of data privacy<\/a> feels like a bit of a trainwreck to you, you\u2019re not alone. In the US, we seem to be on our way to having 50 states all with their own data privacy laws before anything gets passed at the federal level. This lack of decision is affecting adaptation and innovation in the adtech industry. Many companies in the tech space have been frustrated because there is too much uncertainty and without precise rules and parameters, there is no clear path forward.<\/p>\n\n\n\n

This article will explain what could be on the horizon for data privacy regulations, the changes technology companies are making, and what advertisers can do to stay compliant during the next few years of uncertainty.<\/p>\n\n\n\n

What Is Creating Uncertainty in Data Privacy Regulations?<\/h2>\n\n\n\n

There are five main factors creating uncertainty in the direction of data privacy.<\/p>\n\n\n\n

    \n
  1. New data privacy regulations<\/strong><\/a> continue to be created<\/strong> that muddies the water for companies operating across U.S. states and global regions. Example:<\/strong> Ebbie Yazdani, federal policy director at TechNet, told privacy fellows at the National Press the cost of state regulations. \u201cIf we allow a patchwork of state laws to continue building, and\/or if Congress is unable to fully preempt state laws, there\u2019s going to be a tremendous cost to America\u2019s economy and technology leadership,\u201d Yazdani said, citing a study<\/a> that said if 50 states enacted their own privacy laws, it would cost $1 trillion for the economy over 10 years.<\/li>\n<\/ol>\n\n\n\n
      \n
    1. Existing regulations are adding amendments<\/strong> to add further restrictions. California already amended the CCPA with the CPRA and existing federal authorities are extending their reach. Similarly, as lawsuits occur, they add new definitions to regulations, like the Schrems lawsuits have in the EU. Example: <\/strong>The HHS (which regulates HIPAA) provided guidance that would make pseudonymous data PHI under HIPAA<\/a> when collected on sites run by covered entities.\u00a0<\/li>\n<\/ol>\n\n\n\n
        \n
      1. Lawsuits are starting to create havoc<\/strong> with added debate around how to enforce the regulations globally. Additionally, the private right of action in certain state privacy bills increases the likelihood of class action litigation. Example:<\/strong> Lawsuits and fines aren\u2019t just happening in reaction to data breaches. In September 2022, Ireland\u2019s Data Protection Commissioner (DPC) fined Instagram<\/a> for violating children\u2019s privacy under the terms of the GDPR. The long-running complaint concerned data belonging to minors, which was made more public when users upgraded their profiles to business accounts to access analytics tools. Meta is fighting the lawsuit, in disagreement with how the fine was calculated.\u00a0<\/li>\n<\/ol>\n\n\n\n
          \n
        1. The U.S. federal government is struggling to figure out its role<\/strong>. There have been attempts at federal privacy legislation, but they have not been successful. And existing federal bodies are extending their authority to try to cover this gap.\u00a0Example:<\/strong> The federal government has made multiple attempts to pass federal privacy acts. The most notable is the American Data Privacy and Protection Act (ADPPA)<\/a> which has failed to be passed due to concerns over conflict with the California Privacy Act (CPA).\u00a0<\/li>\n<\/ol>\n\n\n\n
            \n
          1. Technology doesn\u2019t have a clear path forward.<\/strong> Companies that collect digital data and create products around data are disagreeing on the appropriate path forward since there isn\u2019t a clear future state for privacy regulations. Example:<\/strong> Google Chrome continues to delay cookie deprecation and enhance their Topics approach in Sandbox, even with concerns from outside parties.<\/li>\n<\/ol>\n\n\n\n

            Throughout all of this uncertainty, data usage is under a microscope from the state Attorney Generals and EU Privacy Regulators. Every company collecting, analyzing, and using data is vulnerable to being targeted with a lawsuit and non-compliance fees.<\/p>\n\n\n\n

            Will a U.S. Federal Law Soon Usurp State Regulations?<\/h2>\n\n\n\n

            At the end of the first quarter of 2023, there were five states with signed data privacy laws and another 19 are in the works\u2014some of which have multiple active bills. It is expected that around four or five of these will get passed in 2023, with the rest to follow in 2024 and future years to come.\u00a0<\/p>\n\n\n\n

            \"\"
            The state of US privacy regulations from iapp (See <\/strong>most current map<\/strong><\/a>)<\/strong><\/figcaption><\/figure>\n\n\n\n

            There have been a few attempts at the federal level to establish new data privacy regulations. Multiple federal leaders, including Sen. Amy Klobuchar (D-Minn.), have introduced federal data privacy laws without success. Sen. Suzan DelBene (D-Wash.) proposed online data privacy legislation<\/a> that would give consumers control over their data and the Federal Trade Commission the right to enforce it.\u00a0<\/p>\n\n\n\n

            The most well-known recent attempt has been the American Data Privacy and Protection Act (ADPPA). The ADPPA was a United States proposed federal online privacy bill that, if enacted into law, would have regulated how organizations keep and use consumer data. Unfortunately, advocates of California\u2019s CCPA felt the ADPPA wasn\u2019t strong enough to protect Californians. House Speaker Pelosi aligned herself with the Californian advocates, issuing a statement<\/a> that the ADPPA, \u201cmust continue to protect Californians \u2014 and states must be allowed to address rapid changes in technology.\u201d\u00a0<\/p>\n\n\n\n

            The American Data Privacy Protection Act (ADPPA) has bipartisan support and is the closest the U.S. has come to passing a comprehensive consumer data privacy law. But it hasn\u2019t passed yet. In 2023 Rep. Kathy McMorris Rogers is expected to reintroduce the bill.<\/p>\n\n\n\n

            Should the ADPPA at some point get passed into law, it is important to understand the differences between it and the CCPA. The ADPPA goes significantly beyond the CCPA in placing the burden of protecting information on those that process it instead of the individuals who generate it. Here are some of the key differences:<\/p>\n\n\n\n