Converging State Privacy Laws and the Emerging AI Challenge

Eight US states passed data privacy legislation in 2023, and in 2024, laws will come into effect in four, including Oregon, Montana, and Texas, each with comprehensive state privacy laws, and Florida, with its far more limited Digital Bill of Rights law. Notably, these laws all share similarities and underscore a national trend toward unified data protection standards in the patchworked US privacy landscape.

While these laws align in many respects — such as exempting employer information and lacking a private right of action — they also exhibit state-specific nuances. For example, Montana's lower threshold for defining personal information, Texas' unique approach to small business definition, and Oregon's detailed personal information categorization illustrate this diversity.

Because of its small population of about a million people, Montana set its threshold much lower than the other states. Because of that decreased threshold, more people may be subject to it than would be otherwise. Montana's privacy law requires companies to conduct data protection assessments to identify high-risk areas where sensitive data is being captured and stored. This law compels businesses to have data protection assessments and processes to ensure that organizations are held accountable.

The Texas privacy law stands out as one of the first in the US to eschew financial thresholds for compliance, basing its criteria on the Small Business Administration's definitions. This innovative approach broadens the law's applicability, ensuring that a broader range of businesses are held accountable for data privacy.

Oregon's law expands the definition of personal information to include linked devices, illustrating the state's commitment to comprehensive data protection. It covers various digital footprints, from fitness watches to online health records. Oregon also includes specific references to gender and transgender individuals in its definition of sensitive information, showing a nuanced approach to privacy.

The laws demonstrate a compelling need for companies to evaluate and ensure data protection addendums in their processes. Accountability is a critical aspect of these laws, reflecting the increased rights and awareness of data subjects. Organizations must establish procedures to enable individuals to exercise their privacy rights effectively, which involves investing in management platforms and monitoring processing activities to ensure compliance.

Generative AI and Its Uses Are Receiving Considerable Attention and Scrutiny

The rise of generative artificial intelligence (GenAI) presents unique challenges in the privacy sector. As AI technologies become integral to businesses, the need for structured policies and processes to manage AI deployment is paramount. The National Institute of Standards and Technology (NIST) has developed a framework to manage AI risks, focusing on design and deployment strategies.

In terms of governance, we often see AI handed over to privacy instead of security because there is a lot of overlap, but in terms of tactical impacts, there are quite a few. Large language models (LLMs) and other AI technologies often utilize extensive unstructured data, raising critical concerns about data categorization, labeling, and security. The potential for AI to inadvertently leak sensitive information is a pressing issue, necessitating vigilant monitoring and robust governance.

It's also important to remember that these AI systems need training, and what they use to train AI systems is your personal information. The recent controversy surrounding Zoom's plan to use personal data for AI training highlights the fine line between legal compliance and public perception.

This year is also pivotal for privacy laws as they intersect with the burgeoning domain of GenAI. The rapid adoption of AI technologies poses fresh challenges for data privacy, particularly in the absence of specific legislation or standardized frameworks. AI's privacy implications vary, from bias in decision-making algorithms to using personal information in AI training. As AI reshapes the landscape, businesses must remain vigilant, ensuring compliance with emerging AI guidelines and evolving state privacy laws.

Four Key Emerging Data Privacy Trends Businesses Should Expect to See This Year

Companies should expect to see many emerging data privacy trends this year, including:

Overall, this is a time for companies to sit back and look deeply at what they're processing, what types of risk they have, how to manage this risk, and their plans to mitigate the risk they've identified. This first step is identifying the risk and then ensuring that, with the risk that's been identified, businesses map out a strategy to comply with all these new regulations that are out there with AI taking over. Organizations should consider whether they are using AI internally, if employees are using AI, and how to ensure they are aware of and tracking this information.