Decoding Data Privacy in the US: A State-by-State Look

Dear readers,

We extend our warmest welcome as we enter the fifth year of publication for Decoded. We express our sincere gratitude for your continued support and readership.

The Current State of US Privacy Laws
By Alexander L. Turner and Malcolm E. Lewis

In contrast to the General Data Protection Regulation (GDPR) of the European Union, the United States has yet to implement a comprehensive nationwide data privacy law. Instead, the country has adopted a sectoral approach, where privacy regulations are limited to specific industries. As a result, individual states have taken the initiative to enact their own data privacy laws to protect the personal data of their residents. California has been at the forefront of this movement with the introduction of the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). The latter established the California Privacy Protection Agency (CPPA) to enforce privacy laws in the state.

Following California’s example, several other states, including Colorado, Connecticut, Utah, and Virginia, have introduced their own data privacy laws. In 2024, three additional states, namely Montana, Oregon, and Texas, are set to implement new privacy laws.

Paying Ransom: A Business Decision
By Alison M. Sacriponte

Organizations faced with ransomware attacks are confronted with difficult decisions. While existing guidelines discourage ransom payments, organizations ultimately need to weigh the decision based on mitigating risk and protecting stakeholders. Key factors for organizations to consider include recovery capabilities, stakeholder interests, data sensitivity, and the credibility of the attackers.

Cybersecurity Compliance: A Step, Not an Endpoint
By Alexander L. Turner

Compliance with industry regulations and cybersecurity standards is essential, but insufficient to address evolving cyber threats. Organizations need to adopt a comprehensive and systematic approach to cybersecurity, integrating continuous monitoring, threat intelligence, and employee training.

Proposed Changes to US Children’s Privacy Rules
By Shane P. Riley

The US Federal Trade Commission (FTC) is soliciting feedback on updating the Children’s Online Privacy Protection (COPPA) rule, with a focus on biometric identifiers and enhancing companies’ responsibilities in safeguarding children’s personal information.

Medical Devices: The Next Hacking Target?
By Hugh B. Wellons

The US FDA and other regulatory groups are concerned that medical devices are the next frontier for cyber attacks. Hacking into these devices could have serious consequences, posing significant risks to patients’ health and safety.

California’s New Personal Data Deletion Bill
By Nicholas P. Mooney II

California’s new law allows residents to request the deletion of their personal data from all data brokers in the state. However, these changes have raised concerns among data brokers regarding potential industry-wide implications.

Challenging BIPA Settlement with Google
By Alexander L. Turner

Plaintiffs of a class-action suit against Google under Illinois’ Biometric Information Protection Act (BIPA) are regrouping for a new lawsuit after rejecting the initial settlement amount, highlighting the complexities and implications of biometric privacy laws.

3D Printing: Revolutionizing Healthcare
By Shane P. Riley

The application of 3D printing in healthcare offers innovative solutions for surgical tools, training models, and organ transplants, presenting a transformative impact on the industry.

Challenges of Biometric Identifiers
By Brian H. Richardson

The reliability and security of biometric technology are influenced by various external factors, including hardware compatibility and changes in biometric characteristics, necessitating the implementation of robust presentation attack detection measures.

Permanent Ban on Facial Recognition Technology in New York Schools
By Nicholas P. Mooney II

New York has made its moratorium on facial recognition technology in schools permanent, following concerns over privacy, accuracy, and potential threats to students’ safety.

We appreciate your consideration of our insights into the ongoing developments in data privacy and technology.

Sincerely,
[Your Name]