Consumer Data Transfers Under New Privacy Laws: Contracting Requirements; Due Diligence; Vendor Management

Description

U.S. consumer privacy compliance continues to evolve as California has strengthened its law and nearly a dozen states have followed with their own legislation. Companies must be aware of what this means for privacy regulation in California and beyond.

As of Jan. 1, 2023, human resources and B-to-B personal data are now fully in scope under CCPA. While the other states have limited the scope of regulation to traditional consumers, most join California in providing special treatment for "high risk" activities such as the sale of personal data, transfers related to targeted (cross-context) advertising, sensitive personal data, and profiling. This includes the need to conduct and document data practice assessments for these activities, including considering vendors and other recipients. Many of the states also require contracts with recipients with requirements for specific provisions.

Since Privacy Shield was invalidated, personal data transfers from the EU to the U.S. have been challenging, necessitating the use of standard contractual clauses (SCCs) or binding corporate rules and complex transfer risk assessments (TRAs)/transfer impact assessments (TIAs). The need for TRAs/TIAs has made use of U.S. vendors to process exported EU personal data challenging. In July 2023, the EU found adequacy for the DPF, designed to replace Privacy Shield, and ruled that transferring under the DPF no longer requires TRAs/TIAs. Learn how to qualify for DPF and how DPF adequacy can be leveraged to aid in completing TRAs/TIAs if SCCs remain the applicable vendor transfer mechanism.

Listen as our authoritative panel of privacy attorneys and consultants clarifies state privacy law and DPF requirements and provides best practices for drafting and modifying documents to ensure continued compliance.