The privacy and security of personal information are critically important issues in today’s world. As people engage in more and more activities online, businesses and other organizations come into possession of massive amounts of personally identifiable information (PII). Hackers, identity thieves, and other bad actors cause billions of dollars in losses every year for consumers and businesses alike. Several states have enacted new comprehensive data security laws that place obligations on businesses to safeguard consumers’ personal information. They also impose penalties for failing to do so. Laws in two states, California and Virginia, have already gone into effect. Laws in Colorado, Connecticut, and Utah will take effect later in 2023.
When Do the New Laws Take Effect?
The laws in California and Virginia took effect on January 1, 2023. The effective dates for the new laws in Colorado, Connecticut, and Utah are as follows:
- Colorado Privacy Act (CPA): July 1, 2023
- Connecticut Data Privacy Act (CTDPA): July 1, 2023
- Utah Consumer Privacy Act (UCPA): December 31, 2023
What Do the New Laws Protect?
The new laws provide broad protection for consumer data privacy and impose obligations on businesses.
Who Do the New Privacy Laws in 2023 Cover?
All three laws generally apply to entities that either do business or target consumers in their respective states, and that meet certain other requirements. The CPA and CTDPA apply to for-profit businesses and certain nonprofit organizations without regard to revenue. The UCPA covers for-profit “controller” or “processor” entities that have at least $25 million in annual revenue. Additional criteria involve the amount of personal information that a business possesses, processes, or sells annually.
What Are Consumers’ Rights under the New Laws?
The CPA, CTDPA, and UCPA offer similar sets of rights for consumers, including:
- To know what information is being used, and how;
- To access personal information;
- To delete personal information;
- To reuse personal information across multiple services or platforms, also known as data portability; and
- To opt out of certain uses of their information.
What Information Do the New Privacy Laws in 2023 Protect?
The three laws have almost identical definitions of “personal information.” The CPA defines it as “information that is linked or reasonably linkable to an identified or identifiable individual.” The laws provide additional protections for “sensitive data,” which may include:
- Race, ethnicity, sexual orientation, medical diagnoses, religious beliefs, and other personal data;
- Genetic or biometric data, when collected for the purpose of identifying someone;
- Geolocation data (Connecticut and Utah); and
- Information collected from someone known to be a child (Colorado).
Who Enforces the New Laws?
The attorneys general in each state will have the authority to enforce these laws. District attorneys in Colorado will also have enforcement powers. None of the laws allow private causes of action by individual consumers. Penalties may include the following fines for each violation:
- Colorado: Up to $20,000
- Connecticut: Up to $5,000
- Utah: Up to $7,500
Learn More
Baer Reed works with in-house counsel to help them deal with issues like confidentiality and data privacy. Contact the firm today to learn more.
Mr. Reyes graduated with honors from the Ateneo de Manila University, where he received the Procter and Gamble Student Excellence Award. He obtained his Juris Doctor degree from the Ateneo de Manila School of Law. During law school, Mr. Reyes was part of the Philippine delegation to the Willem C. Vis International Commercial Arbitration Moot held in Vienna, Austria. He was also a member of the Ateneo Society of International Law and the St. Thomas More Debate Society. He completed his internship at the Public Attorney’s Office. He wrote a thesis entitled: “To Kill A White Elephant: An Analysis of the Fiduciary Exception to the Corporate Attorney-Client Privilege”. Mr. Reyes is admitted to practice law in the Philippines and the State of New York.
Ms. Lardizabal-Manzano is a graduate of San Sebastian College-Recoletos, where she earned her B.A. in Political Science. In 2003, she received her law degree from Lyceum of the Philippines and was admitted to practice law in 2004.
Matthew Hersh earned a B.A. in Political Science from Columbia University in 1990 and graduated cum laude from Georgetown University Law Center in 1999. He also holds a master’s degree in international relations from the Georgetown University School of Foreign Service.
Cap. Avi Levak (Res. IDF) graduated from from Israel’s prestigious Ben-Gurion University of the Negev with a Bachelor of Science in Computer Science and Mathematics. He is also a Leadership and Communication coach trained in TuT coaching by Alon gal in Israel. Avi specializes in high-level, in-depth analysis of business and client needs, within systems and software strategy and architecture.
Ms. Tyler graduated cum laude from Georgetown University and received her law degree, cum laude, from Georgetown University Law Center. During law school, she interned at the United Nations Economic Commission for Europe. She also worked on The Tax Lawyer journal and was a member of the award-winning Barristers’ Council Mock Trial Team. Ms. Tyler is admitted to practice law in the State of California and the District of Columbia.
Ms. Cruz-Anonuevo graduated cum laude and top nine in her batch from Miriam College with a degree of Bachelor of Arts in InternationalStudies. She obtained her Juris Doctor degree from Ateneo de Manila University School of Law in Rockwell. During law school, she interned in Rivera, Santos, Maranan & Associates. She was also part of Ateneo’s Labor Law Bar Operations. She wrote her thesis on, “Stealing Privacy: Limitations on Media’s Photographic Invasion.,” Ms. Cruz-Anonuevo is admitted to practice law in the Philippines.
Ms. Aquino-Batallones obtained a Bachelor of Arts degree in Development Studies (with Minors in Global Politics and Hispanic Studies) from the Ateneo de Manila University. In 2011, she received her Juris Doctor degree from Ateneo de Manila University School of Law. During law school, she interned at Romulo Mabanta Buenaventura Sayoc & de los Angeles then became an intern of Ateneo Legal Services Center’s Clinical Legal Education Program.
Mr. De Guzman graduated from San Beda College with a degree of Bachelor of Arts Major in Economics and received his law degree from San Beda College of Law. He is multilingual and is fluent in three languages: Chinese, Filipino, and English. He was admitted to the Philippine Bar in 2003.