Riding The California Privacy Wave
Wherever your business is headquartered-on the Midwest’s grassy plains or in the South’s sweltering cities-you have to deal with the new tide of legislation swelling out of the Golden State.
CIO — California. It's where the nation looks for the next hot trend in fashion, business, religion, technology--you name it--that will eventually end up in your state or hometown. The Golden State is where McDonald's hamburgers began their inexorable march eastward, where smoking was first banned in restaurants, where the original Earth Day was held and where the New Age movement began. These trends altered American culture to such an extent that they gave rise to the maxim, "As California goes, so goes the nation."
Now get ready for the next California phenomenon with the potential to profoundly affect your lives as CIOs: a wave of privacy legislation aimed at protecting consumers' personal information. These laws will put a much greater onus on corporations and organizations to manage their data more securely--or face stiff sanctions and lawsuits. The California state legislature has already enacted more than a dozen laws that regulate how businesses, universities and other organizations that collect personal information on California residents must manage private data.
And that's just the beginning. California legislators are prepared to introduce more privacy bills when the state legislature convenes this month, including, among other things, bills to regulate the use of radio frequency identification (RFID) and how companies outsource data. Even Congress is getting in on the act. It is considering in committee a bill that mirrors the California law about notifying customers when a security breach occurs. And states are beginning to consider privacy bills that restrict outsourcing operations that involve personal information.
"You are going to continue to see more legislation, and particularly more legislation out of California," warns Peggy Eisenhauer, counsel head of the privacy and information management practice for the Atlanta law firm Hunton & Williams.
Like a large hurricane sweeping in off the Pacific, these laws will wreak havoc on all kinds of business processes, including how websites can collect personal data and the management of databases that store personal information on customers. They will influence how companies share personal data with third parties and restrict their ability to contact consumers via cell phones and faxes. State lawmakers are also considering laws that could affect how your company outsources services that handle personal information. And keep in mind: Any company that sells a product or service to a California resident, even if the company is based outside the state, may be affected. Just having a website that a California resident visits--and one out of 10 Americans lives in California--can put you under the jurisdiction of these laws.
