Compliance fatigue: Can states stay on top of privacy monitoring?

With data privacy laws enacted in three states and more than 50 bills in the legislative process in 25 others, state agencies must prepare to ensure that companies comply with them. But that could prove tricky for many reasons, an expert says.

Several factors are at play, said Bill Tolson, vice president of global compliance at Archive360. For one, data privacy laws differ from state to state, much like requirements around Freedom of Information Act requests. Although the laws and bills have common themes – individuals’ right to know what data about them is being stored and how it’s used, their right to correct inaccurate data and the right to be forgotten or have their data erased – the nuances in each are problematic for companies trying to craft policies that are in compliance with a variety of state laws.

“You can have the right to erasure, but what does that mean in the New York bill vs. the Virginia [law]? There’s differences,” Tolson said. Some state bills say individuals would have to opt in to allowing companies to use their personally identifiable information, while California’s, Colorado’s and Virginia’s laws permit them to opt out.

Another issue is private right of action, which would let individuals sue companies directly for privacy breaches. Federal law does not provide a private right of action, but several state data privacy laws do or would. “The New York bill has it in there, California obviously has it in there, and a lot of the new bills that have not been brought into law yet have it,” Tolson said.

In states that don’t allow for right of action, lawsuits must be brought by the attorney general’s office, he added. “Many of the states … are basically relying on the states’ attorneys general offices to be the one that recognizes, manages, responds to complaints and goes out and sues these [businesses],” he said. “These attorneys generals and their departments are not built for this.”

California established the California Privacy Protection Agency, according to the state’s Privacy Rights Act, which voters approved in November 2020. Tolson predicted that its role and capabilities will grow to include responding to data subject access requests (DSARs) and legal actions.

Individuals make DSARs to companies to find out what data the businesses have on them, and the average company receives about 140 such requests per month, research shows. Gartner estimates that each response costs $1,400, or more than $191,000 per month, while IDC estimates it to cost more than $200,000.

Those numbers are a turnoff to companies, Tolson said, especially because “that 147 [requests] per month is going to skyrocket…. The  overall costs will probably go from $200,000 a month to millions of dollars a month just responding to these things.”

That could put companies out of business, and it begs the question, would a state or would an agency continue to do business with an organization that is not meeting state law? “I think in some cases they will and some cases they won’t. What they’ll end up doing is potentially suing them for large amounts of money and still do business with them,” Tolson said.

Many bills include a privacy impact assessment, which means a neutral third party has examined how a company handles data and how well it’s set up to meet laws. If they don’t pass the assessment, “that would be a valid way for a state to stop doing business with an organization,” Tolson said.

For example, Virginia’s law states that a controller conduct and document a data protection assessment for the processing of personal data for targeted advertising, sale and profiling. “The Attorney General may request, pursuant to an investigative civil demand, that a controller disclose any data protection assessment that is relevant to an investigation conducted by the Attorney General, and the controller shall make the data protection assessment available to the Attorney General,” the law states.

Another approach to monitoring for compliance with data law is to emulate the European Union’s approach with the General Data Protection Regulation, the gold standard of data privacy laws, and go after the “big guys like Facebook, Google and Microsoft,” Tolson said. Over the last three years, EU governments are “actively looking at organizations to see if they’re compliant. Obviously, they’re getting a lot of complaints from data subjects and that helps them focus.”

It’s likely that tools to automate these compliance processes will crop up, he added. In fact, Gartner estimates that more than 40% of privacy compliance technology will rely on artificial intelligence by 2023, up from 5% in 2020.

Ultimately, companies must invest in understanding states’ data rules and regulations – and the tools to respond to individuals’ requests – while state agencies must begin building the capability to enforce the law.

“What we’re looking at is both companies and government trying to track an ever-growing number of requirements that are slightly different from geographic state to geographic state,” Tolson said. “What we’re approaching is an extremely complex problem, both for organizations as well as government agencies to figure out.”

Stephanie Kanowitz is a freelance writer based in northern Virginia.