FOLLOW US

The red-hot battlefield of data privacy and security is set to blaze even brighter in 2024. The landscape is abuzz with the anticipation of several new state privacy laws, poised to escalate the ongoing regulatory storm fueled by artificial intelligence. As the pace quickens, practitioners brace for the formidable task of holding executives accountable for cybersecurity-related disclosure deficiencies.

Cybersecurity & Privacy Policy To Watch In 2024 :The Growth of State Privacy Laws, Enforcement

In a labyrinth of legal intricacies, the state data privacy law count more than doubled in 2023. Iowa, Indiana, Tennessee, Montana, Florida, Texas, Oregon, and Delaware joined the fray, creating a tapestry of complexity alongside the existing 13 states with comprehensive laws. Legal minds predict this trend to continue its explosive trajectory in the coming year.

"I certainly expect more [comprehensive data privacy] laws in 2024," warns Kirk Nahra, co-chair of the cybersecurity and privacy practice at WilmerHale. The battleground shifts towards whether these laws will push the envelope, creating fresh challenges for corporate America.

While the new laws vary in scope, they consistently demand companies to ensure consumer access, deletion, correction, and opt-out capabilities. Yet, the prospect of novel state laws, introducing measures like blanket opt-in consent or empowering consumers to sue for alleged violations, could create compliance quagmires and Congressional stalemates.

State-Level Showdowns and Enforcement Challenges

No frontrunners emerge in the race to add more patches to the privacy law quilt in 2024. New York, Massachusetts, Hawaii, Maine, and Wisconsin, among others, are potential players, introducing proposals with game-changing provisions.

Utah set the stage by closing out 2023 with its privacy statute taking effect. In the upcoming year, the spotlight will shift to Oregon and Texas, with laws going live on July 1, and Montana's Consumer Data Privacy Act implementation slated for October 1. Simultaneously, the enforcement tempo will rise in California, Connecticut, Colorado, and Virginia, where investigations are set to conclude.

California, armed with the California Privacy Protection Agency, faces delays due to a court ruling, but the anticipation is that enforcement will pick up swiftly in 2024. Reed Smith LLP's Monique Bhargava warns, "Companies should expect to see more enforcement activity in California once the regulations are enforceable," signaling a broader enforcement trend across states.

Congressional Quagmire and Children's Privacy Challenges

As state-level battles intensify, Congress faces increasing pressure for federal legislation to provide a more uniform approach. While comprehensive data privacy legislation remains unlikely, there's a glimmer of hope for a narrower proposal, particularly addressing children's privacy.