2024 Q1 Compliance Roundup
Navigating the complexities of state laws that impact employment policies and procedures, including...
Data privacy has been a top priority for employers the past several years. With no comprehensive federal privacy law, states are deciding how to handle privacy matters themselves. While each of these laws have their own nuances and requirements, adding to the already complex patchwork of laws for employers to navigate, they essentially all require businesses to take reasonable steps to protect consumer data privacy, confidentiality, and integrity.
Ready to create your own background screening package with a provider who can help you navigate through compliance? Get Started Now.
The goal of these laws is to protect an individual’s privacy rights and ensure that their personal data is handled responsibly and securely. Data privacy laws often require organizations to obtain consent from individuals before collecting their personal information, implement measures to safeguard data against unauthorized access or disclosure, and provide individuals with rights to access, correct, or delete their personal data. With new privacy laws being enacted across the country on nearly a monthly basis, employers must stay diligent in their compliance efforts. To help, we’ve compiled the latest privacy laws for review.
The following states have enacted data privacy laws since January of 2024.
On January 16, 2024, the New Jersey Data Privacy Law was signed into law. Under the law, controllers (individuals or legal entities that determine the purpose and means of processing personal information) that conduct business in the state or produce products or services targeted to state residents and within the calendar year (i) control or process personal data of at least 100,000 New Jersey consumers or (ii) control or process personal data of 25,000 New Jersey consumers and derive revenue (or receive discounts) from the sale of personal data, must provide consumers with certain rights.
Consumers (defined as New Jersey residents acting only in an individual or household context) may:
Among other obligations, the law requires controllers to provide consumers a “reasonably accessible, clear, and meaningful” privacy notice that includes:
New Jersey’s data privacy law will become effective January 15, 2025.
On March 6, 2024, New Hampshire enacted the New Hampshire Privacy Act. Under the law, controllers (individuals or legal entities that determine the purpose and means of processing personal information) that conduct business in the state (or produce products or services targeted to state residents) and within a one-year time period (i) control or process personal data of at least 35,000 New Hampshire consumers or (ii) control or process personal data of 10,000 New Hampshire consumers and derive more than 25% of gross revenue from the sale of personal data, must provide consumers with certain rights.
New Hampshire consumers (defined as New Hampshire residents acting only in a personal capacity) have the following rights under the new law:
Among other obligations, New Hampshire’s law requires controllers to provide consumers a “reasonably accessible, clear, and meaningful” privacy notice that includes the following:
New Hampshire’s data privacy law will become effective January 1, 2025.
On April 4, 2024, Kentucky enacted the Kentucky Consumer Data Protection Act (“Kentucky CDPA”). Under the law, controllers (individuals or legal entities that determine the purpose and means of processing personal information) who either conduct business in the Commonwealth of Kentucky or produce products or services targeted to residents of Kentucky and who, within the calendar year, either (i) control or process personal data of at least 100,000 Kentucky consumers or (ii) control or process personal data of 25,000 Kentucky consumers and derive over 50% of gross revenue from the sale of personal data, must provide consumers with certain rights.
Kentucky consumers (defined as a Kentucky resident acting only in an individual context) have the following rights under the new law:
Among other obligations, Kentucky’s law requires controllers to provide consumers a “reasonably accessible, clear, and meaningful” privacy notice that includes the following:
Kentucky’s data privacy law will become effective January 1, 2026.
On April 17, 2024, Nebraska enacted the Nebraska Data Privacy Act, which imposes obligations on controllers—a person that conducts business in Nebraska or produces a product or service consumed by residents of Nebraska; processes or engages in the sale of personal data; and is not a small business as determined under the federal Small Business Act, except if such person engages in the sale of sensitive data without receiving prior consent from the consumer.
Nebraska’s law is broader than many other states in that it does not contain a revenue threshold nor a minimum number of consumers whose personal data is processed or sold for it to apply (similar to Texas’s law).
Nebraska consumers (defined as Nebraska residents acting only in an individual or household, and not in a commercial or employment, context) have the following rights under the new law:
Among other obligations, the law requires controllers to provide consumers a “reasonably accessible and clear” privacy notice that includes:
Similar to the California Consumer Privacy Act and the Connecticut Data Privacy Act, “sale” is broadly defined as the exchange of personal data for monetary or other valuable consideration by the controller to a third party. The law also imposes requirements on “processors”—a person who processes personal data on behalf of a controller.
Nebraska’s data privacy law will become effective January 1, 2025.
On May 9, 2024, Maryland enacted the Maryland Online Data Privacy Act. Under the comprehensive law, controllers (individuals or legal entities that, along or jointly with others, determine the purpose and means of processing personal information) that conduct business in the state or produce products or services targeted to state residents and within the calendar year (i) control or process personal data of at least 35,000 Maryland consumers or (ii) control or process personal data of 10,000 Maryland consumers and derive more than 20% of gross revenue (a lower threshold than most other states) from the sale of personal data, must provide consumers with certain rights.
Maryland consumers (defined as Maryland residents acting only in a personal capacity) have the following rights under the new law:
Among other obligations, Maryland’s law requires controllers to provide consumers a “reasonably accessible, clear, and meaningful” privacy notice that includes the following:
Maryland’s data privacy law will become effective October 1, 2025.
In this rapidly evolving data privacy environment, staying informed by proactively monitoring legislative changes is key for employers. A comprehensive strategy may include:
While using these and other strategies is helpful, as always, employers should consult legal counsel and a PBSA-accredited background screening partner about compliance matters.
Orange Tree Employment Screening helps companies win their race to fill open positions by providing fast and easy background check and drug testing services. We are committed to helping our clients stay updated with compliance, such as with the AI regulatory landscape, create safer workplaces, mitigate financial risk, and avoid legal exposure. We forge long-term partnerships with our clients by offering a full range of technology-led screening solutions predicated on best practice and legally defensible screening programs. To get started with a background screening program tailored to your needs, you can schedule time to Speak with Our Team.