In recent years, data privacy has been a top priority for consumers and businesses around the world, and the United States is no exception — resulting in a surge in data privacy legislation. Many U.S. states have implemented new privacy laws that have or will go into effect in 2023. Additionally, other U.S. states (including Iowa, where our agency is headquartered) will have their own privacy laws coming into effect during 2024 and beyond.
The increasing focus on data privacy legislation is a positive development for consumers. These laws give consumers more control over their personal data and help protect them from potential harms, such as identity theft and discrimination. But what are the implications for businesses and the compliance requirements with these laws?
What is data privacy?
Data privacy is the right of individuals to control their personal information. This includes the right to know what Personal Identifiable Information (PPI) is being collected about them, how it is being used, and who can have access to it. Users have the right to opt out of having their personal information collected or used and to request that their information be deleted.
It’s important for B2B businesses to pay attention to data privacy when collecting and using a large amount of personal data about customers, employees, and partners. No matter whether this data is being used for sales and marketing, product development, or customer support, it must be used responsibly and protected from unauthorized access or use.
Main requirements of data privacy laws in the U.S.
Data privacy laws vary from state to state, but there are some common requirements regarding compliance:
Transparency: By providing consumers with an updated privacy policy, businesses can explain what personal information is being collected, how it is used, and who has access to it.
Consent: This consent must be freely given, informed, and specific, and it must include the kind of information being collected.
Accessibility: Consumers must be able to opt out of having their personal information collected or used, including the right to opt out of targeted advertising. Some states are required to inform users how they can access, request, or delete their PPI.
Although there are many state-level regulations in place, there is not yet a nationwide law regarding PPI. However, the American Data Privacy and Protection Act (ADPPA) is a proposed U.S. federal law that would establish comprehensive data privacy protections for consumers.
The ADPPA is still under development, but it has the potential to be a major step forward for data privacy in the United States. If passed, it would help protect consumers from data privacy misuse and give users more control over their own information.The ADPPA would also offer businesses and marketers more consistency and predictability in privacy compliance instead of requiring them to stay on top of a patchwork of state policies.
Data privacy laws and regulations worldwide
Businesses that operate internationally should be aware of the various data privacy laws and regulations that apply to them. The laws and regulations impose a number of obligations on businesses that collect, use, or store personal data. Some of the most notable international data privacy regulations include:
General Data Protection Regulation (GDPR): Regulation about data protection and privacy for all individuals within the European Union (EU) and the European Economic Area (EEA). It also addresses the transfer of personal data outside the EU and EEA.
Personal Information Protection and Electronic Documents Act (PIPEDA): Canadian federal law that applies to all businesses that collect, use, or disclose personal data in the course of commercial activity. It requires businesses to obtain consent from individuals before collecting their personal data and to give individuals the right to access, correct, and delete their personal data.
Canadian Anti-Spam Legislation (CASL): Prohibits the sending of unsolicited commercial electronic messages to individuals unless the individual has given express consent to receive such messages. CASL also imposes restrictions on the collection of email addresses and other electronic contact information.
Brazil General Data Protection Law (LGPD): A Brazilian federal law that regulates the processing of personal data. It is similar to the GDPR but it has some additional requirements, including noting that businesses must appoint a data protection officer if they process the personal data of more than 10 million individuals.
What does it mean to comply with data privacy laws?
Data privacy compliance is a serious issue for B2B businesses. Compliance with all applicable laws and regulations can help you protect your brand reputation, avoid costly fines and penalties, and gain a competitive advantage by helping tailor your efforts to the right audiences.
“It’s important for B2B businesses to pay attention to data privacy when collecting and using a large amount of personal data about customers, employees, and partners.”
From a marketing standpoint, failing to comply with data privacy regulations can lead to inefficiencies in data management, ineffective targeting, and challenges in tailoring your marketing efforts to the target audience, which can ultimately reduce engagement and conversions.
Here are some steps you can use as a baseline to comply with most data privacy laws:
- Review your privacy policy: Make sure your company’s privacy policy is compliant with all applicable data privacy laws. This includes ensuring that it is clear, concise, and easy to find and understand.
- Obtain consent: Obtain consent from consumers before collecting or using their personal information. This can be done through a variety of methods, such as forms or checkboxes on your website.
- Give consumers choices: Provide a way for consumers to opt out of having their personal information collected or used. This includes the right to opt out of targeted advertising. You can do this by providing a clear and easy way to opt out on your website or in your app.
- Invest in security measures to protect personal data: These should be tailored to the specific risks that your business faces and should be regularly reviewed and updated to ensure they are effective. These security measures should include physical (e.g., control systems), technical (e.g., detection systems and data encryption), and administrative (e.g., policies, procedures, and employee training).
- Be prepared to respond to requests: Data privacy laws around the world typically require businesses to respond to requests from individuals about their personal data in a timely manner. The specific timelines vary from law to law, but they generally include an initial period of response and a specific lookback period.
Be aware of data privacy laws
Data privacy is a complex and evolving topic. By complying with necessary laws and using data privacy to their advantage, businesses can build trust with consumers, protect their data, and improve marketing campaigns.
This content represents Two Rivers Marketing’s understanding and interpretation of publicly available information on data privacy. We are not legal experts or attorneys. Therefore, we strongly advise consulting with a qualified legal professional to ensure that your business is fully compliant with all relevant data privacy laws and regulations.
If you need help navigating how data privacy laws and regulations impact your marketing efforts or if you want to learn more about how to protect customer data, connect with us. We can partner with your marketing and legal teams to help you develop and implement a data privacy program that meets your specific needs and transforms your digital experience.
By Hillary Ferry
By Patrick McGill
By Two Rivers Marketing