Privacy Law

Updated June 04, 2024 20:28

State / Jurisdiction

Federal / All

Federal Data Privacy Law Proposed

So far the American Privacy Rights Act (APRA) is in "discussion draft" form but has received bipartisan support and has potential to pass in 2024. This comprehensive data privacy law would establish national consumer data privacy rights and by limiting the types of data that companies can collect and by requiring access rights and data removal, in addition to the right of consumers to opt out of targeted advertising and a company's use of decision-making algorithms. This federal law would supersede state laws such as California's Consumer Privacy Rights Act (CPRA), although it remains to be seen whether industry-specific regulations would be permitted for those not covered in the national law. Currently employment data is not specifically referenced in the APRA.

OFCCP Guidance on Use of AI in Employment

The Office of Federal Contract Compliance Programs (OFCCP) published a new web page on April 30, 2024, that is dedicated to guidance on the use of artificial intelligence. The new launch page also includes a joint statement on the use of artificial intelligence (AI) by various government agencies regarding enforcement of civil rights, fair competition, consumer protection, and equal opportunity laws in automated systems.

Artificial Intelligence Standards for Federal Agencies

The Office of Management and Budget (OMB) issued guidance on risk management practices when artificial intelligence applications, including employment-related applications, impact an individual's rights. While this guidance is specific to federal agencies, it will likely be used as a basis for private sector legislation. The guidance that was published on March 28, 2024, is known as Memorandum M-24-10, "Advancing Governance, Innovation, and Risk Management for Agency Use of Artificial Intelligence."

California

California Consumer Privacy Act in Effect and Enforceable

With the recent court drama surrounding the effective date of enforcement of new regulations, it's a reminder for businesses to ensure they are in compliance with all the existing CCPA regulations in effect. Specifically, employers should make sure their job applicant notices and privacy policies are updated and ensure their website tools and banners for cookies/pixels/beacons are compliant. For some context of the recent legal activities, an appeals court decision (on 2/9/2024) made regulations enforceable immediately followed by the swift return to the original March 29, 2024 deadline when that decision was overturned shortly thereafter. For more information, see this recent Fisher Phillips article.

Illinois

Illinois Clarifies Damages for Privacy Act Violations

The Illinois General Assembly has passed a bill prohibiting claims for per-scan damages under the Biometric Information Privacy Act (Privacy Act or BIPA), and it is now awaiting signature by Governor Pritzker. Illinois Senate Bill 2979 would overrule the state Supreme Court’s interpretation of what constitutes a violation of the Act in Cothron v. White Castle System, Inc. and would limit the recovery of statutory damages, and it also allows for electronically signed consent. For more details, see this article by Ogletree Deakins.

Illinois to Amend BIPA and Limit Recoverable Damages

The Illinois Senate recently amended the Biometric Information Privacy Act (BIPA) to limit statutory damages under the Act to a single recovery for each individual rather than each instance of the biometric data collection. SB 2979 clarifies the legislative liability for violations of BIPA and is currently under consideration by the Illinois General Assembly's House of Representatives now that the Senate has passed the bill. We will continue to monitor the progress of this legislation. Additional information is found in this article by Seyfarth Shaw.

3rd party link Disclaimer: These links are being provided as a convenience and for informational purposes only; they do not constitute an endorsement or an approval by [The author] of any of the products, services or opinions of the corporation or organization or individual. [The author] bears no responsibility for the accuracy, legality or content of the external site or for that of subsequent links. Contact the external site for answers to questions regarding its content.