U.S. Regulators Lift the Curtain on Data Practices with Assessment, Reporting and Audit Requirements

Unlike the GDPR, the first generation CCPA was light on affirmative due diligence requirements and many companies designed data privacy and protection programs that were little more than window dressing (e.g., privacy policies and a consumer rights request process). In the second generation of state consumer privacy laws and regulations, as well as in recent laws pertaining to the privacy of minors (such as in California and Connecticut), numerous states require affirmative due diligence and a structured approach for conducting and documenting risk assessments and associated remediation. The assessment documentation must be available for review by regulators, and the CPRA requires risk assessments to be filed with the state, a requirement that is currently under consideration in a condensed form with certification by the executive officer. This means that companies subject to the applicable state privacy laws need to develop or refine their data inventory and assessment practices as a top priority in 2024 to be prepared for the coming enforcement of these requirements.