Data privacy regulations continue to take shape across the country.
Dealerships are preparing to comply with the updated federal Safeguards Rule, which outlines how financial institutions protect consumers’ personal information, before the new requirements take effect in December. Dealerships are considered financial institutions under the rule because they offer financing agreements.
Two more states — Utah and Connecticut — this year adopted privacy statutes, following California, Colorado and Virginia in recent years.
Now Congress is debating a federal data privacy bill that some say has the best shot at passing of any such legislation in years, with lawmakers appearing to reach some compromise on issues such as whether a national standard would preempt state standards.
“Increasingly, industry is clamoring for a federal privacy law because a patchwork of state laws creates a lot of challenges on the compliance front,” said Caitlin Fennessy, chief knowledge officer of the International Association of Privacy Professionals, a membership association that tracks state legislation and has been following the federal effort.
She called the federal bill “the best chance we’ve seen in two decades toward the adoption of a U.S. federal privacy law.”
“We haven’t seen major divergences in terms of the [state-level] approaches, but they’re far from uniform, so it takes a lot of work to get familiar with each of these new laws and ensure compliance,” Fennessy told me last week. “Data is obviously not limited to one state, so companies are having to work to comply with all of them simultaneously.”
Compliance experts have told me that dealerships should consider taking additional steps to protect their customers’ data, even if they don’t operate in a state bound by a privacy law, as a way to stay ahead of future legislation. It’s also a way to earn the trust of consumers and establish privacy as a brand promise, they’ve said.
A federal privacy law is not a done deal. But momentum around securing consumers’ information will continue.