Survey: Few states have ‘established’ privacy program

The U.S. currently doesn’t have a national data privacy law. In its absence is an executive order and pending legislation in Congress that would punish data brokers for transferring Americans’ personal information to foreign rivals like China.

Congress’ inability to pass national data privacy legislation, even as it has held numerous hearings on the topic, has left states to fill in the gaps. And to date, 22 have done just that, with 15 enacting comprehensive protections for their residents and the rest addressing targeted issues such as protecting biometric identifiers and health data.

A new survey from the National Association of State Chief Information Officers shows just how far along many of these efforts are and how much work is still ahead as states race to protect Americans’ personal information and stay competitive with other countries that have comprehensive national data privacy regulations in place.

To start, the survey identified how many states have created a chief privacy officer role, or tasked someone with protecting privacy. That number climbed most dramatically in the last five years, from 15 in 2019 to 25 today. More than half said they are the first to hold the position in their state. Of those, 17 filled out this recent survey.

The survey indicated that many states’ privacy programs are still in their early stages. Just 24% of respondents said they have an established privacy program in their state, while 41% said they are currently developing one and 35% said they don’t have one.

That’s down slightly from two years ago, when 29% of survey respondents said their states had an established data privacy program. NASCIO said the decline may be because some chief privacy officers may believe their programs are “just not mature enough” to be deemed established, even if they are active.

Only four states specified what privacy framework they use: Three said they follow the National Institute of Standards and Technology’s Privacy Framework, while the remaining one said they follow privacy-by-design principles.

Those that have implemented a framework say they have established, trained and certified a point of contact at every agency; conducted privacy impact assessments; developed rules, policies, statements and guidance; conducted broader training; and implemented data-sharing programs, mapping and governance.

New to this year’s survey is that more respondents reported offering training programs to agency heads: 41% said they offer training, while others are either “developing it, encouraging it or requesting it.” Training varies from monthly to annually in its timing, with the majority saying they offer it once a year.

Chief privacy officers reported many “pain points” including two that NASCIO said it hears each time it conducts the survey. “Lack of funding and authority prevent [officers] from fully implementing the state privacy programs that are needed across the nation,” the group wrote in the report.

A lack of qualified staff was also cited as another issue by survey respondents.

Three states said they had a defined budget for privacy, up from just one in 2022, and two states said there is money in their budgets for privacy spread across various areas of spending.

Just 20% of chief privacy officers said they have the authority to enforce compliance with privacy policies at the enterprise level, and 27% said their policies are enforced by another entity or are not enforced at all.

Chief privacy officers said they have a mix of duties in both policy and operations. In the former, that means planning, business strategy, enterprise architecture, policy formation and budgeting. And in the latter, that primarily includes responding to incidents and training. Eighty-one percent of survey participants said that citizen privacy and internal government privacy were among their responsibilities, while just 6% reported consumer privacy as their duty.

Almost 70% said they are involved in procurement, compared to 59% in 2022. NASCIO said that growth “likely shows the increasing importance of considering privacy in the procurement process.”

Among its recommendations, NASCIO suggests that states give their chief privacy officers the proper authority, that the role should have a defined budget and staff, and that privacy analysts are hired at the agency level to help with the “day-to-day execution of the privacy program.” Training on the subject, the group added, will ensure departments have a privacy “champion.”

Some of those surveyed said that while the role can be challenging, it is a great opportunity to lead a state government in its privacy initiatives.

“Privacy is too important to not get right,” one respondent said, “and in government, privacy needs to be operationalized in a way that it will exist and function with [chief privacy officer] turnover.”