Report: Almost half of state consumer privacy laws fail to protect individuals’ data

Nearly half of state consumer privacy laws fail to adequately protect individuals’ data and have made consumer protections weaker than they were before the laws were passed, according to a report released Tuesday.

Of 19 states with data privacy laws, eight failed an assessment conducted by two leading advocacy groups, the Electronic Privacy Information Center (EPIC) and U.S. PIRG Education Fund.

“Many of these ‘privacy laws’ protect privacy in name only,” Caitriona Fitzgerald, deputy director of EPIC, said in a statement. “In effect, they allow companies to continue hoarding our personal data and using it for whatever purposes they want.”

The findings showed that two states — Maryland and California — have enacted good data privacy laws. Maryland, the more recently enacted of the two, limits what data companies can collect about consumers, prohibits sensitive data sales and bans targeted advertising to minors. 

Lawmakers in Vermont, Massachusetts and Maine are now working on comprehensive consumer privacy laws that are as strong as Maryland’s, EPIC and U.S. PIRG said in a press release.

Many state privacy laws are built off a template that was originally written by industry, the report asserts. While consumers are told the laws are designed to protect their privacy, they are written in a way that gives people no real ability to exercise their privacy rights, it says.

Strong privacy laws should require companies to minimize the amount of consumer data they collect, regulate all uses of sensitive data, prevent consumers from being profiled with their data and provide strong enforcement mechanisms, the report argues.

Seventeen of the 19 states profiled received a C+ or below and none received an A on the report card compiled by the advocacy organizations, reflecting the fact that the provisions outlined above were largely left out of the state bills.