By Sakshi Udavant
None of the 50 states in America have strong privacy laws, while 26 of them have regulations that are considered “very weak,” according to a recent survey.
The survey was conducted by Gabe Turner, content director of Security.org, and his research team to classify states by how strong their data-privacy laws are.
“From the outset, it was evident that clear objectives were needed in order to grade each state,” Turner told Digital Privacy News. “These were chosen because they constitute many of the general elements on which privacy advocates agree.”
He noted that “many of these rights are represented or at least discussed” leading up to the European Union’s adoption of its General Data Protection Regulation (GDPR) in 2016.
In its analysis, Security.org considered the 15 most common digital-privacy provisions that most advocates agree on. The states then were divided into five “buckets” — groups based on the privacy legislation proposed or passed in each state.
How the States Stack Up
Here how the nation’s 50 states fared in the Security.org analysis, based on categories and key criteria:
- Very Strong: Includes all 15 data-privacy protections and requirements. No states.
- Strong: At least 1 of 15 protections and requirements: California, Maine, Nevada.
- Pending: Active legislation that includes at least one of the 15 protections and requirements, though nothing has formally been adopted: Arizona, Florida, Illinois, Maryland, Minnesota, Nebraska, New Hampshire, New York, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Virginia, Wisconsin.
- Weak: No active legislation, but recent measures have included at least one protection or requirement: Connecticut, Hawaii, Louisiana, Massachusetts, North Dakota, Texas.
- Very Weak: No active or recent legislation: Alabama, Alaska, Arkansas, Colorado, Delaware, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Michigan, Mississippi, Missouri, Montana, New Jersey, New Mexico, Ohio, Oregon, South Dakota, Tennessee, Utah, Vermont, Washington, West Virginia, Wyoming.
The buckets were “very strong,” “strong,” “pending,” “weak” and “very weak.”
Turner’s analysis found none of the 50 states falling into the “very strong” bucket, while 26 were found to have “very weak” regulations.
With 47 states offering little to no privacy protection, providing a single provision automatically put a state at the top, he told Digital Privacy News.
“I believe our paper is quite sympathetic to state legislatures and allows them to be considered strong or very strong for having done very little … when it comes to digital privacy,” Turner said.
Karen Gullo of the Electronic Frontier Foundation in San Francisco said Security.org’s research highlighted the need for state legislatures to change their approach to digital-privacy laws.
“At present, consumers have little in the way of protection over their personal information,” she told Digital Privacy News. “Few states have consumer-privacy laws in place.
“This needs to change,” Gullo continued. “Strong privacy legislation is necessary and long overdue.”
Because so few states have strong privacy laws, Turner called for federal legislation.
“Federal law can function as a baseline — and then states can add supplemental guidelines and policies.”
Gabe Turner, Security.org.
“At least some level of law should apply equally from one state to another,” he told Digital Privacy News. “Federal law can function as a baseline — and then states can add supplemental guidelines and policies.”
But Gullo warned: “Privacy laws must avoid federal preemption, ensure consumers have a private right of action and use nondiscrimination rules to avoid pay-for-privacy schemes.
“In addition, privacy legislation must establish the right to opt-in consent, the right to know and the right to data portability.”
Gullo said the foundation also would like to “see data-privacy legislation include information fiduciary rules, data-broker registration and data-breach protection and notification.”
Has the coronavirus pandemic led states to move swiftly on protecting privacy?
“Legislatures have been moving very slowly on this,” Turner told Digital Privacy News, “and while they may believe COVID-19 covers them from legislating on anything else, for the time being, I think the digital shift this is forcing upon our society will very quickly impose upon local governments the importance of strengthening digital privacy.”
Sakshi Udavant is a writer based in India.
Sources (external links):