Privacy Policies as an Asset – or Liability
Recent Privacy Laws Make Privacy Policies More Challenging
At the same time, the differences between the laws create challenges. The laws are inconsistent in their key definitions (such as the definition of personal information), and the rights they confer are different as well. Since online commerce inevitably flows across state borders, firms must consider each of these laws and create policies that fit each of their requirements. This effort can result in a complicated policy that may create more questions than it answers.
Moreover, we can expect additional state laws, as well as implementing regulations (such as the regulations expected to be promulgated on July 8, 2022 by the California Privacy Protection Agency). New laws and new regulations, even when they do not explicitly target privacy policies, can have an impact requiring companies to review and update their policies.
Avoiding Key Mistakes
- A detailed inventory of the data the company collects, how it is collected, and what it is used for, with an emphasis on the jurisdictions from which data is collected, and how data can be stored not just in databases, but in emails, reports, and personal devices;
- Understanding whether and how the company collects sensitive personal information, such as health, financial and geo-location information;
- Analysis of existing security procedures to ensure that personal information is protected; and
- Policies and procedures for responding to individual rights requests, including a means of keeping close track of those requests and the means by which they will be validated.
Creating the Policy
Robert E. Braun is the co-chair of the Cybersecurity and Privacy Law Group at Jeffer Mangels Butler & Mitchell LLP. Bob helps clients to develop and implement privacy and information security policies, negotiate agreements for technologies and data management services, and comply with legal and regulatory requirements. He helps clients to develop and implement data breach response plans, and he and his team respond quickly to clients’ needs when a data breach occurs. Contact Bob at RBraun@jmbm.com or +1 310.785.5331.
JMBM’s Cybersecurity and Privacy Group counsels clients in a wide variety of industries, including accounting firms, law firms, business management firms and family offices, in matters ranging from development of cybersecurity strategies, creation of data security and privacy policies, responding to data breaches and regulatory inquiries and investigations, and crisis management. The Cybersecurity and Privacy Group uses a focused intake methodology that permits clients to get a reliable sense of their cybersecurity readiness and to determine optimal, client-specific approaches to cybersecurity.