Many companies are moving toward a national approach to privacy compliance to account for the growing patchwork of state laws, Wiley attorneys said in a blog post Thursday.
Data Minimization
Data minimization is a core privacy principle requiring organizations to limit the personal data they collect, process and retain to only what is necessary for a specific purpose. Maryland’s data privacy law sets one of the nation’s strictest standards mandating that companies collect only the minimum data needed and prohibiting use beyond that stated purpose. The approach has drawn attention from other states with several exploring similar provisions to curb overcollection and reduce the risks of misuse, breaches and noncompliance.
Transport companies lack legitimate interest under the EU General Data Protection Regulation (GDPR) in requiring customers to indicate their title before purchasing train tickets, the European Court of Justice (ECJ) held in a preliminary ruling Thursday.
Consumer advocates want to build a coalition behind a model state privacy bill that adds protections beyond current state laws, said Electronic Privacy Information Center (EPIC) and Consumer Reports (CR) officials in a Monday column in TechPolicy.press. The groups’ model, unveiled in September, is based on Connecticut's law, with additions including a private right of action, tightened data minimization requirements and increased protections for children and sensitive data. “EPIC and Consumer Reports hope to use the model bill to build on last session’s momentum and support lawmakers seeking strong privacy protections for their constituents,” wrote EPIC Deputy Director Caitriona Fitzgerald and CR Policy Analyst Matt Schwartz. “We are actively seeking new partners to join our coalition -- both organizations and constituents fed up with the status quo.” A forthcoming Washington state privacy bill will be based on the EPIC/CR model (see 2412300043).
Businesses must make incremental changes to comply with five state privacy laws effective this month, privacy experts said in interviews. Comprehensive laws took effect Jan. 1 in Delaware, Iowa, Nebraska and New Hampshire. A New Jersey law becomes effective Jan. 15, with that state’s attorney general office’s consumer affairs division soon expected to open a rulemaking.
Vermont and Washington state will soon introduce comprehensive privacy bills, while Connecticut will have a bill that would add data minimization rules and make other changes to its 2022 law, legislators told Privacy Daily ahead of sessions starting this month. Also, legislators in Oklahoma and South Carolina prefiled bills last month for the 2025 legislative sessions. Additional privacy bills are expected this year in several other states, said privacy lawyers and consumer advocates in other interviews.