How Can We Help Our Clients Keep Up With Privacy Laws?

• Jurisdiction: European Union,United States,Federal,California
• Citation: Vol. 47 No. 4
• Publication year: 2022
• Author: Jay Parkhill
• topic: Business of Law,Contracts

HOW CAN WE HELP OUR CLIENTS KEEP UP WITH PRIVACY LAWS?

Jay Parkhill
Parkhill Venture Counsel, P.C.

Privacy law is in a period of very rapid evolution. Even ten years ago the pace of change was incremental; it now seems constantly increasing. It's difficult for practitioners to keep up with developments, and it's an even bigger struggle for our clients to manage their obligations to their end users and business customers. This article will provide a brief overview of the state of flux in privacy law, and potential frameworks for managing business relationships.

A BRIEF HISTORY OF PRIVACY LAW UPDATES

The European Union led privacy law developments for decades. The first major EU privacy law was the Privacy Directive in 1995. It lasted for 23 years until it was replaced by GDPR in 2018, and that's when the pace of activity really picked up. The internet, online advertising and SaaS have all dramatically changed how personal data is stored, collected and used, and GDPR was the first major privacy law of the internet era. As such it has had a big influence on legislation in other countries.

The United Kingdom was part of the EU until Brexit in January 2020. That means GDPR applied in the EU from 2018-2020. Post-Brexit the UK Parliament essentially cloned GDPR into UK law, so now we have [EU] GDPR and UK GDPR. As of now they are mostly identical, though we can expect them to diverge over time.

US law is also changing. Before the California Consumer Privacy Act (CCPA) went online in 2020 almost all US privacy laws regulated specific industries, e.g., Health Insurance Portability and Accountability Act (1996) (HIPAA) for health care and Gramm-Leach Bliley for financial transactions. CCPA was a milestone because it provides the broadest rights of any US law, and because it covers the most people by virtue of California's size. CCPA itself will be superseded by the California Privacy Rights Act in 2023, and has been joined by the Colorado Privacy Act (2021), Connecticut Data Privacy Act (2023), Virginia Consumer Data Protection Act (2021) and Utah Consumer Privacy Protection Act (2022). Several bills have been introduced in the US Congress to create an equivalent federal-level privacy law, though none have passed yet.

[Page 57]

Finally, comprehensive privacy laws have also been enacted in other major markets including Brazil (the LGPD in 2020), and China (several laws enacted in 2022). The Indian Parliament has proposed and withdrawn several proposed laws in recent years.

...