The US has what appears to be a never-ending list of comprehensive privacy laws, but do they all apply to your organization? Not necessarily.
Let’s recap. Since we last wrote at the beginning of the month about preparing for these laws, some things have changed. Eight comprehensive privacy laws have now been passed (California, Colorado, Connecticut, Indiana, Iowa, Montana, Tennessee, Utah, and Virginia) and one more is expected to pass soon (Florida). Two are already in effect (California and Virginia) and two will go into effect on July 1, 2023 (Colorado and Connecticut).
Which of these laws should your organization worry about? First, as a baseline, your organization must be doing business in that state. Second, only California applies beyond consumers (to employees and employees of third parties). Third, many have revenue triggers: California ($25 million), Florida ($1 billion), Tennessee ($25 million), and Utah ($25 million). The latter three apply these amounts as a baseline before the law applies. Finally, the laws apply only if the company processes information about a certain number of individuals in the state (175,000 in Tennessee; 100,000 in California, Colorado, Indiana, Utah and Virginia; 50,000 in Montana) or sell information about certain threshold number of individuals (or engage in another covered activity, in particular Florida). The applicability triggers for each state are outlined below:
Even if your organization meets these thresholds, the law may still not apply, or not in all cases. All laws except California exempt entities that are in regulated industries like health care and financial services. California, on the other hand, exempts only the information that is subject to the regulations of these industries (i.e., GLBA, HIPAA). Outlined below are (some of) the many exemptions and states in which they exist:
Putting It Into Practice: As you review the upcoming law’s requirements, it is helpful to keep in mind their applicability thresholds – and their exceptions. While we may see more states pass similar comprehensive laws in the coming months, their applicability thresholds may be a similar patchwork.
