FOLLOW US

The red-hot battlefield of data privacy and security is set to blaze even brighter in 2024. The landscape is abuzz with the anticipation of several new state privacy laws, poised to escalate the ongoing regulatory storm fueled by artificial intelligence. As the pace quickens, practitioners brace for the formidable task of holding executives accountable for cybersecurity-related disclosure deficiencies.

Cybersecurity & Privacy Policy To Watch In 2024 :The Growth of State Privacy Laws, Enforcement

In a labyrinth of legal intricacies, the state data privacy law count more than doubled in 2023. Iowa, Indiana, Tennessee, Montana, Florida, Texas, Oregon, and Delaware joined the fray, creating a tapestry of complexity alongside the existing 13 states with comprehensive laws. Legal minds predict this trend to continue its explosive trajectory in the coming year.

"I certainly expect more [comprehensive data privacy] laws in 2024," warns Kirk Nahra, co-chair of the cybersecurity and privacy practice at WilmerHale. The battleground shifts towards whether these laws will push the envelope, creating fresh challenges for corporate America.

While the new laws vary in scope, they consistently demand companies to ensure consumer access, deletion, correction, and opt-out capabilities. Yet, the prospect of novel state laws, introducing measures like blanket opt-in consent or empowering consumers to sue for alleged violations, could create compliance quagmires and Congressional stalemates.

State-Level Showdowns and Enforcement Challenges

No frontrunners emerge in the race to add more patches to the privacy law quilt in 2024. New York, Massachusetts, Hawaii, Maine, and Wisconsin, among others, are potential players, introducing proposals with game-changing provisions.

Utah set the stage by closing out 2023 with its privacy statute taking effect. In the upcoming year, the spotlight will shift to Oregon and Texas, with laws going live on July 1, and Montana's Consumer Data Privacy Act implementation slated for October 1. Simultaneously, the enforcement tempo will rise in California, Connecticut, Colorado, and Virginia, where investigations are set to conclude.

California, armed with the California Privacy Protection Agency, faces delays due to a court ruling, but the anticipation is that enforcement will pick up swiftly in 2024. Reed Smith LLP's Monique Bhargava warns, "Companies should expect to see more enforcement activity in California once the regulations are enforceable," signaling a broader enforcement trend across states.

Congressional Quagmire and Children's Privacy Challenges

As state-level battles intensify, Congress faces increasing pressure for federal legislation to provide a more uniform approach. While comprehensive data privacy legislation remains unlikely, there's a glimmer of hope for a narrower proposal, particularly addressing children's privacy.

The Senate Commerce Committee made strides in 2023, advancing an online safety bill in July. Yet, challenges persist, with successful court rulings against state-level efforts to enhance children's online safety and privacy. Constitutional doubts linger over age verification requirements, setting the stage for a judicial showdown in 2024.

Cybersecurity & Privacy Policy To Watch In 2024 : Regulators Stepping Up Cybersecurity Game

The regulatory spotlight on companies' ability to safeguard personal information intensifies as federal and state regulators embrace a more aggressive approach. The SEC finalizes rules for public companies' cybersecurity disclosures, and the FTC amplifies cyber governance and reporting obligations for financial institutions.

"Overall, 2023 met if not exceeded our expectations for the evolution of the cybersecurity regulatory space," says Caleb Skeath, a data privacy and cybersecurity partner at Covington & Burling LLP. Anticipating continued momentum, the SEC eyes enhanced cybersecurity standards for various market participants, while the Cybersecurity and Infrastructure Agency prepares to unveil rules for vital infrastructure operators.

The FTC, with its "creative aggressiveness," is expected to push boundaries in privacy and data security activities, creating new obligations. As the regulatory saga unfolds, 2024 promises to be a thrilling chapter in the ever-evolving landscape of cybersecurity and privacy policies.