Page 36 - Cyber Defense eMagazine August 2024

P. 36

in the Oregon law also includes a consumer’s national origin, status as transgender or non-binary, and
status as a victim of crime.

Looking Ahead

As more state consumer privacy laws come into effect over the course of the next couple of years,
businesses should carefully consider whether they are covered and adjust their privacy compliance
programs to account for the different requirements and nuances in the applicable laws. The Montana
Consumer Data Privacy Act will become effective in October. Other states with privacy laws coming into
force within the next several years include Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota,
Nebraska, New Hampshire, New Jersey, Rhode Island, and Tennessee. These laws contain many of the
same major features found in the eight laws that are already in effect, but there are slight differences and
nuances that can have a significant impact on applicability and requirements. As more states enact data
privacy laws, keeping track of the differences will be an important, and in some ways, challenging
exercise in developing and maintaining an adaptable compliance program. Furthermore, the possibility
that Congress will pass a comprehensive federal privacy law anytime soon seems unlikely. On April 7,
U.S. Senator Maria Cantwell, Chair of the Senate Committee on Commerce, Science and Transportation,
and U.S. Representative Cathy McMorris Rodgers unveiled draft legislation for the American Privacy
Rights Act. There have been some updates to the draft since as well as a Senate Commerce Committee
hearing on the “Need to Protect Americans’ Privacy and the AI Accelerant”. However, significant hurdles
remain, and we do not anticipate a federal data privacy law passing this year.

About the Authors

Carolyn Ho and Sarah Rugnetta are New York-based attorneys at Constangy, Brooks, Smith & Prophete
LLP and members of the firm’s Constangy Cyber Team, which may be reached at
[email protected].

31 32 33 34 35 36 37 38 39 40 41