In our previous "Conversation on Compliance" blog, we talked about some of the numerous high-profile data protection laws that have emerged in recent years and their implications on contracts.
In this blog, we dig even deeper into data privacy and share the latest developments on two specific regulations: the American Data Privacy and Protection Act (ADPPA) and the General Data Protection Regulation (GDPR).
Here's what to expect in 2023 and how you can keep your contracts — and your entire company — one step ahead in a complex compliance landscape:
While it seems unlikely that the ADPPA will pass in a lame-duck session of congress, the proposed data privacy law makes one thing clear: comprehensive federal privacy regulation isn't a matter of "if" but "when."
Similar to the GDPR, the ADPPA would be a major step forward in protecting individual privacy rights and governing how enterprises gather, store, and use consumer data. If passed, the ADPPA would grant individuals the right to access, correct, erase, and obtain a portable copy of their covered data, as well as require their consent before collecting or processing sensitive covered data. It would also permit individuals to opt-out of transfers of covered data (e.g., targeted advertising).
For businesses confused by the growing patchwork of industry and state-specific privacy laws, the ADPPA is a promising solution for streamlining compliance obligations. However, uncertainty around preemption and enforcement could still kill the bill.
Under the proposed bill, the ADPPA would overwrite stronger state privacy laws — like the California Consumer Privacy Act (CCPA) — and be enforced by the Federal Trade Commission (FTC), which has historically struggled with privacy enforcement. Once the new congressional session begins in January, two important questions will need to be answered: Will preemption and enforcement be adjusted to pass the bill? And if the bill doesn’t pass, what new proposed federal privacy law will take its place?
Regardless of the ADPPA outcome, the writing is on the wall: data privacy is top of mind for lawmakers, and a federal law will take effect eventually. Now is the time for general counsel to consider its impact on contract templates, negotiations, and amending vendor and customer contracts. If passed, the ADPPA would affect clauses pertaining to data, such as Data Owner, Data Residency, Data Processing, and Data Breach Provision — so we recommend auditing your contracts to determine whether you need to update your templates and/or send amendments to comply with the new law.
In October, President Biden signed an Executive Order to implement the new EU-U.S. Data Privacy Framework (DPF) — a historic step toward restoring transatlantic data flows that comply with GDPR requirements and are "critical to enabling the $7.1 trillion EU-U.S. economic relationship," according to a fact sheet released by the White House.
Once approved, the EU-U.S. DPF will replace the EU-U.S. Privacy Shield, which the Court of Justice of the European Union (CJEU) declared invalid in part because of inadequate redress rights for individuals. The new DPF will create an "independent and binding mechanism" for individuals in the EU to seek redress if they believe their personal data was collected through U.S. signals intelligence unlawfully.
The European Commission is set to publish its draft adequacy decision as early as December 12, then launch its adoption procedure which includes obtaining an opinion by the European Data Protection Board and gaining approval from EU member states. The formal adoption process is anticipated to take about six months so, once approved, the new framework could be in place as early as March 2023.
While it's unlikely that the adequacy decision will affect contract templates immediately, now is a good time to reevaluate your compliance protocols. A few questions to consider:
The biggest lesson for this quarter is that inaction isn't an option for general counsel. From continuing education to adopting CLM software, here are three ways to stay one step ahead of compliance:
With the new congressional session starting and the DPF adequacy decision on the horizon, 2023 will likely be a major turning point for data privacy. Stay tuned for our next quarterly installment of “Conversation on Compliance” and, in the meantime, check out our blog for more contract management trends and tips.