The increase in massive ransomware and cybersecurity breaches creates pressure for governments to protect the data of consumers. Data privacy legislation defines what information must be secured against loss due to a cybersecurity attack, and the consequences if there is a breach of consumer data. The credit union industry is no stranger to data privacy legislation, since all financial institutions are subject to securing member information through the Gramm-Leach-Bliley Act, or GLBA. However, some of these state laws expand the scope of the data that must be protected, and in some cases give the right for consumers to sue the organization if the data holder fails to meet the standards outlined in the law.

Several states are considering or have passed their own version of consumer data privacy legislation or enhancements to existing laws on the books. While only a few new laws have been enacted so far, there have been literally hundreds of bills that address privacy, cybersecurity, and data breaches introduced throughout the fifty states. This legislative activity closely mirrors the same process as state data breach notification regulations in the 2010s, where eventually all 50 states ended up passing data breach notification laws by 2018.

If the history of state data breach notifications is any guide, many if not all states will have some kind of data privacy legislation on their books by 2030. For credit unions and CUSOs, understanding the scope of applicable data privacy legislation and managing the risk accordingly will be important for both risk management and examination preparation.

Scope of legislation

There is some good news to begin with. Financial institutions will be exempt from compliance with any state data privacy legislation that conflicts with GLBA. Thus, the California Consumer Privacy Act has language specifically exempting “… personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act (Public Law 106-102), and implementing regulations…”. The Constitution of the United States grants federal legislation supremacy over any conflicting state law. Therefore, consumer or member information obtained by a credit union as part of providing a financial product or service will be regulated by GLBA and not state law. Of course, credit unions and CUSOs still need to be compliant with GLBA when establishing or refining information technology controls around member information.

Examples of the type of information likely exempt from most data privacy statutes will be such items as IP addresses and information collected through cookies from consumers accessing account information in online and mobile banking, as well as consumer transaction information processed by the credit union. Information that would likely be covered under a data privacy statute includes personal information collected through marketing promotions.

For example, under the California Consumer Privacy Act (CCPA), email addresses are now considered personal information that must be protected. If a credit union collects email addresses as part of a promotion, a California resident not otherwise a member can request that their email information be deleted. The California resident has this right because the email address was obtained through a marketing promotion and not part of providing a financial product or service. Thus, credit unions and CUSOs should know the context in which information is provided can determine whether or not a state data privacy law applies. Information can be exempt because the credit union obtained the data in the context of providing a financial service; but the identical information might not be exempt if obtained in the context of a marketing campaign or promotion.

Private right of action

A “private right of action” in the context of data privacy legislation means consumers can sue organizations that violate the statute, including as part of troublesome and expensive class action lawsuits. In California, a data breach attributable to a failure to implement reasonable security procedures and practices appropriate to the nature of the personal information allows each consumer to recover of up to $750 per incident, or actual damages, whichever is greater. Plaintiff class action attorneys will certainly test this law, but on paper it would mean a business that did not implement reasonable security measures resulting in a breach affecting 20,000 consumers would potentially be liable for no less than $15,000,000 in damages.

An important note to remember, even if a statute does not grant a private right of action, consumers may be able to sue individually or as part of a class action under a different legal theory, such as negligence. Consumers may be able to show that violation of a state statute, even one that does not provide consumers with a legal remedy, can still be used to prove negligence under certain conditions. Therefore, credit union and CUSO compliance with state data privacy laws will still be important to avoid consumer lawsuits.

Current state data privacy laws summarized

What about the United States Congress?

All state data privacy laws could be moot if the federal government passes comprehensive data privacy legislation. Multiple bills have been introduced in the U.S. Congress, including the Consumer Data Privacy and Security Act and the Setting an American Framework to Ensure Data Access, Transparency, and Accountability Act (SAFE DATA Act) that have sweeping data privacy language in the initial draft of the legislation. Some of the data privacy legislation under consideration by Congress that could affect credit unions and CUSOs include:

* This is not a comprehensive list, as there are over 20 data privacy and related bills under consideration in the 117^th Congress. The bills listed here are more likely than the others to affect the financial services industry if enacted.

However, as with a federal breach notification standard, Congress has not yet been able to pass uniform requirements for data privacy. For the immediate future, states are more likely to enact data privacy legislation than Congress, although the recent wave of nationally reported ransomware and other malicious cybersecurity incidents will increase pressure on Congress to act.

Data privacy is now, not later

Headline-grabbing cybersecurity events strongly pressure state governments to respond by introducing or enforcing data privacy legislation. Credit unions and CUSOs should understand if they are subject to a state’s data privacy legislation and modify security procedures and protocols as necessary. IT staff and risk managers should know what information is in-scope under state data privacy laws and, under what circumstances this information should be protected.

For example, consumer information otherwise exempt from state law if provided in conjunction with a financial product or service might not be exempt if this same information is obtained through a different context, such as a marketing promotion. Effort to protect information should be proportional to the risk, for example credit unions and CUSOs should consider the possible damages if consumers have a right to sue the organization in the event of a data breach.