Compliance Stuff

Pennsylvania could soon join the growing list of states to enact comprehensive data privacy laws, and businesses that operate in PA must take note. Earlier this month, the commonwealth’s House passed a bipartisan consumer privacy bill that would set parameters on the collection and sale of consumers’ personal data. We’ll explain everything you need to know about HB 78, why it’s important, and six steps your business should consider taking now. Quick Background Pennsylvania’s  HB 78 , which passed the state’s House of Representatives on October 1, would establish the Consumer Data Privacy Act (CDPA) if ultimately approved by the state Senate and Gov. Josh Shapiro. T he bill, like its predecessors in other states, is intended to provide consumers with greater control over the collection, use, and sale of personal data . But unlike California’s data privacy law, PA’s proposed law would  not  cover employment-related information. Snapshot of the Proposed CDPA If enacted,...

While website privacy notices are now commonplace – and consumers might only skim them – a recent settlement highlights the importance of staying vigilant about complying with applicable consumer privacy laws. The Connecticut Attorney General recently reached an $85k settlement with a company whose privacy notice was deemed deficient under the state’s laws. How can you avoid the same fate? If your business is subject to state consumer privacy laws – and most companies are – failure to make sure your privacy notice complies with applicable law could lead to both monetary and non-monetary penalties. Here’s what led to the recent settlement and six steps you can take to ensure compliance. What Happened? Settlement Details:  T he Connecticut Office of the Attorney General announced on July 8 that it had reached a settlement with TicketNetwork, Inc., a company that the AG had previously said was not complying with the requirements of the Connecticut Data Privacy Act (CTDPA) . Tick...

  On April 17, 2024, Nebraska’s governor signed   Legislative Bill 1074 , which establishes a consumer data privacy law for the state. Nebraska’s law takes effect  January 1, 2025 . To Whom does the law apply? The law applies to businesses that: Conduct business in Nebraska or produce a product or service consumed by residents of Nebraska. Process or sell personal data of residents of Nebraska. Are not a small business as defined under the federal Small Business Act. Note that, unlike the comprehensive privacy laws in most other states, Nebraska’s law does not condition the application of the law on certain thresholds, such as the number of consumers from whom the entity collects personal information. The statute also provides a combination of exemptions based on entity and type of data. Specifically, the statute excludes certain entities such as financial institutions subject to the Gramm-Leach-Bliley Act (GLBA), institutions of higher education, and entities that are co...