Privacy Laws Don't Guarantee Enforcement, Privacy Expert Says
Though many states in recent years have passed privacy legislation, the provisions in the law are not necessarily being enforced if there is no funding for enforcement, said Miles Light from the Children’s Advertising Review Unit with Better Business Bureau National Programs in a panel at Thursday’s preconference workshop of the Student Privacy and Parental Consent: Legal Innovations and Global Insights, hosted by Public Interest Privacy Center (PIPC), Toyo University and George Washington Law.
Sign up for a free preview to unlock the rest of this article
“I'm very interested [in] going to the fiscal note [of privacy bills] of whatever they're saying they're going to need for enforcing the law and then trying to follow up a year later [and] see what's in the budget bill,” he said. “Did they actually fund an enforcement program within their state? The vast majority of states that have set up some sort of state privacy law have not necessarily put up the money in order to be able to effectuate that enforcement.”
Some states, like California, Texas and Kentucky, are outliers to this idea, Light said. In the fiscal note of Kentucky’s privacy bill, $1 million was reported as the amount needed for enforcement, and this year they actually funded it, he said.
“In many ways, when you're thinking about compliance, you're thinking about the actual statistical risk of a lot of this,” Light said. “It's probably a good thing to know what states are putting up the money for enforcement, what states are maybe using enforcement as a means to get money for future enforcement, because they have not been funded by their state legislatures or by their governors.”
This is also an important thing to think about when discussing the right to cure, he said. “For many states, I think there's very low likelihood that the right-to-cure period is actually going to be a period in which there is active enforcement,” Light said.