PRIVACY: What is the issue?

As Americans are sharing more personal data and as the internet has enabled companies to collect more personal data, it is important to ensure that nonprofit organizations are ethical custodians of the data with which they are entrusted, and also have access to the information to enable them to further their missions. 

Why do nonprofits care?

• Donor trust is foundational to nonprofits’ ability to raise funds and provide services. 
• Organizations use consumer data and third-party data providers to ensure our programmatic and fundraising marketing messages are delivered to those most likely to benefit – and, likewise, not to those who will not. 
• At times we also use consumer data, including aggregated depersonalized data, to assess need, measure effectiveness, and better direct resources to the people and places that need it the most. 
• Nonprofits rely on commercial data companies to maintain data in secure environments at a level that many nonprofits could not afford to maintain on their own, certainly not without significantly reducing the funds available to spend on direct mission-focused work.

What is the Ideal Policy?

TNPA calls upon Congress to enact a national privacy statute for the proper handling of data, to both protect consumers and allow for the legitimate use of data:

• Federal legislation to create a single, clear, uniform set of national standards and guidelines.
• Include a clear preemption of any current or future state privacy statutes to create national consistency of laws.
• Require litigation of federal privacy legislation be filed in only federal court (and not state courts), which would create greater national uniformity of enforcement. 
• No Private Right of Action, which could result in a proliferation of class action lawsuits, many of which would be frivolous.

For an in-depth discussion of these points and policy proposals, read  TNPA’s Discussion Points in Preparation for Drafting Federal Legislation Called The Individual Privacy Act.

What is the Current Situation?

U.S. Federal Law: 

Over the years a number of federal laws have been passed dealing with portions of the handling of data, however there is no broad-based federal statute to address the overall question of how data should be handled to better protect the privacy of consumers, while setting out clear guidelines for the proper use of data by businesses.

On December 20, 2022, the Omnibus Spending Package to fund the federal government through the end of the fiscal year (September 30, 2023) did NOT include the language of H.R. 8152, the American Data Privacy and Protection Act, which was reported out of the House Energy & Commerce Committee earlier in 2022. As proposed in July, 2022 H.R. 8152 included fifteen “carveouts” which would allow current state privacy-related statutes to stay in force. The bill also allowed for a Private Right of Action, which could lead to frivolous class action lawsuits.

Since H.R. 8152 was not included in the “must pass” Omnibus Spending Package, it was thus not enacted into law before Congress officially closed out the 117th Congress at year end. Accordingly, H.R. 8152 “died,” as all legislation which has not passed does at the end of a two-year congressional cycle. With the new 118th Congress having convened in January, Congress started over with a clean slate.

On June 21, a new comprehensive privacy proposal was made public, H.R. 8818, the American Privacy Rights Act (APRA). Unfortunately, the new legislation still allows portions of the California Consumer Privacy Act and the Illinois Biometric Law to continue without federal preemption. TNPA has consistently believed that a comprehensive national privacy law should include an unambiguous preemption of current or future state privacy statutes, allowing for one uniform national standard for the responsible use of data.

Additionally, the legislation also continues to provide for a private right of action (allowing for class-action lawsuits). Liability to the private right of action does not require the actual demonstration of harm but could be triggered by a minor violation of the legislation.

The House Energy & Commerce Committee had planned to consider the legislation on June 27, however strong opposition by a number of committee members resulted an indefinite postponement for consideration of the bill. Given the two controversial provisions cited above, it is unlikely the bill will be considered this year.

The link for the full text of the legislation is here. Also, the section-by-section review of the legislation prepared by the House Energy & Commerce Committee is here.

Far-reaching, highly impactful legislation — which comprehensive national privacy legislation clearly is — often takes several two-year Congresses to gain enactment.

(See below for individual states)

In the States:
What to keep an eye on

California State Law:

California Consumer Privacy Act (CCPA) of 2018

• It does exempt nonprofit organizations from its restrictions.
• However, the burdens placed on corporate providers of data to nonprofits have stopped many small- to mid-sized data providers from doing business in California, creating obstacles and extra expense for nonprofits communicating with supporters in California. 

According to the California Attorney General’s website:

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. This law secures new privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

Businesses are required to give consumers certain notices explaining their privacy practices. The CCPA applies to many businesses, including data brokers.

California Privacy Rights Act (CPRA) of 2020 

• Modified the CCPA (above) when approved via ballot initiative Proposition 24 in November 2020.
• Creation of a new California Privacy Protection Agency. 
• The key provisions of the CPRA will NOT go into effect until January 1, 2023.

Colorado State Law:

Colorado SB 190 , the Protect Personal Data Privacy Act, was signed into law on July 7, 2021, and took effect on July 1, 2023. Major provisions include: 

• Enable a consumer to opt-out of the processing of their personal information. 
• Confirm whether or not a controller is processing personal data concerning the consumer and to provide access to that information. 
• The right to correct inaccurate personal information. 
• The right to have personal information deleted.
• Controllers would be required to provide a meaningful privacy notice to consumers detailing their various rights
• Does not contain a private right of action.

Nonprofit organizations are NOT exempted from the requirements of the law.

Notes:

• The statute does not prescribe fundraising, but unlike other states, registering to solicit in the state is considered “doing business” in Colorado.
• To fall under the jurisdiction of the statute, an organization must have personal data on 100,000 or more Coloradans; or receive revenue or discounts from the sale of data (e.g., list rental and exchange) and have data for 25,000 or more Coloradans.

Connecticut State Law:

Connecticut SB 6/Public Act 22-15, sponsored by Senate President Pro Tempore Martin Looney, D-New Haven, was signed on May 10, 2022, and took effect on July 1, 2023. The law grants consumers various rights including:

• The right to confirm whether or not a controller is processing the consumer’s personal data.
• The right to correct inaccuracies in their personal data.
• The right to delete personal data provided by or obtained about the consumer.
• The right to obtain a copy of the consumer’s personal data processed by the controller.
• The right to opt out of the processing of the personal data for the purposes of targeted advertising, the sale of personal data or profiling in furtherance of decisions that produce legal or similarly significant effects.

Controllers will be required to respond to verified consumer requests within 45 days but could request an extension of an additional 45 days. Controllers will also be prohibited from processing the sensitive data of a consumer without their affirmative consent. The law will not apply to nonprofit organizations, does not provide a private right of action and will grant controllers a right to cure at the discretion of the attorney general. The law will also specify that a controller is not required to authenticate an opt-out request but will be able to deny a request if the controller has reasonable and documented belief that the request is fraudulent. Controllers will be required to send notice to the person making the request that they believe the request is fraudulent.

Utah State Law:

Utah SB 227 was signed March 24, 2022, and took effect on December 31, 2023. The law grants consumer’s various rights including:

• The right to confirm whether a controller is processing the consumer’s personal data and to access their data.
• The right to correct inaccurate personal data.
• The right to delete the consumer’s personal data.
• The right to obtain their personal data in an easily portable format.
• The right to opt-out of the processing of their data for the purposes of targeted advertising or the sale of personal data.

The law does not apply to nonprofit organizations and does not contain a private right of action.

Virginia State Law:

Virginia SB 1392, the Virginia Consumer Data Protection Act, was signed into law on March 2, 2021, and took effect on January 1, 2023.  The CDPA grants consumers the right to confirm, correct, and delete personal data and opt-out of use of data for advertising or sale.  It includes an opt-in consent requirement for sensitive data.  Nonprofits are largely exempt.

Other States

Other states have considered their own new state privacy statutes over the past few years, risking the creation of a “patchwork quilt” of varying, and often conflicting, state privacy laws. 

Click here for more information about privacy legislation being proposed in state legislatures.