PRIVACY: What is the issue?

As the internet has enabled companies to collect more personal data, it is important to ensure that nonprofit organizations are ethical custodians of the data with which they are entrusted and also have access to information that enables them to further their missions. 

Why do nonprofits care?

• Donor trust is foundational to nonprofits’ ability to raise funds and provide services. 
• Organizations use consumer data and third-party data providers to ensure our programmatic and fundraising marketing messages are delivered to those most likely to benefit – and, likewise, not to those who will not. 
• Nonprofits use consumer data, including aggregated depersonalized data, to assess needs, measure effectiveness, and better direct resources to the people and places that need them the most. 
• Nonprofits rely on commercial data companies to maintain data in secure environments at a level that many nonprofits could not afford to maintain on their own, certainly not without significantly reducing the funds available to spend on direct mission-focused work.

What is the Ideal Policy?

TNPA calls upon Congress to enact a national privacy statute for the proper handling of data, to both protect consumers and allow for the legitimate use of data:

• Federal legislation to create a single, clear, uniform set of national standards and guidelines.
• Include a clear preemption of any current or future state privacy statutes to create national consistency of laws.
• Require litigation of federal privacy legislation be filed in only federal court (and not state courts), which would create greater national uniformity of enforcement. 
• No Private Right of Action, which could result in a proliferation of class action lawsuits, many of which would be frivolous.

For an in-depth discussion of these points and policy proposals, read  TNPA’s Discussion Points in Preparation for Drafting Federal Legislation Called The Individual Privacy Act.

What is the Current Situation?

U.S. Federal Law: 

Over the years, Congress has considered a number of federal laws dealing with portions of the handling of data. However, there is no broad-based federal statute to address the overall question of how data should be handled to better protect the privacy of consumers while setting out clear guidelines for the proper use of data by businesses.

In December 2022, the Omnibus Spending Package to fund the federal government through the end of the fiscal year (September 30, 2023) did not include the language of H.R. 8152, the American Data Privacy and Protection Act, which was reported out of the House Energy & Commerce Committee earlier in the year. H.R. 8152 included fifteen “carveouts” which would allow current state privacy-related statutes to stay in force. The bill also allowed for a Private Right of Action, which could lead to frivolous class action lawsuits. Since H.R. 8152 was not included in the “must pass” Omnibus Spending Package, it was not enacted into law before Congress officially closed out the 117th Congress at year’s end. Accordingly, H.R. 8152 died, as all legislation that has not passed does at the end of a two-year congressional cycle.

In the 118th Congress, 2023-2024, there was consideration of H.R. 8818, the American Privacy Rights Act (APRA). Unfortunately, this legislation still allowed portions of the state laws to continue without federal preemption. TNPA has consistently believed that a comprehensive national privacy law should include an unambiguous preemption of current or future state privacy statutes, allowing for one uniform national standard for the responsible use of data. Additionally, the legislation also provided for liability to  a private right of action that could be triggered by a minor violation of the legislation without requiring the actual demonstration of harm. The House Energy & Commerce Committee had planned to consider the legislation in June 2024; however, strong opposition by a number of committee members resulted an indefinite postponement for consideration of the bill. The link for the full text of the legislation is here. Also, the section-by-section review of the legislation prepared by the House Energy & Commerce Committee is here.

The 119th Congress: 

The change in Senate control to a Republican majority could have a significant impact. Several advocates for national privacy legislation will be in important positions: Sen. John Thune (R-SD) is Majority Leader, Sen. Ted Cruz (R-TX) is chairing the all-important Senate Commerce Committee, and Sen. Jerry Moran (R-KS) is serving on Senate Commerce. These three Senators have a long history of advocating for national privacy legislation that will preempt existing and future state statutes.

In the States:
What to keep an eye on

California State Law:

California Consumer Privacy Act (CCPA) of 2018

• It does exempt nonprofit organizations from its restrictions.
• However, the burdens placed on corporate providers of data to nonprofits have stopped many small- to mid-sized data providers from doing business in California, creating obstacles and extra expense for nonprofits communicating with supporters in California. 

According to the California Attorney General’s website:

The California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them and the CCPA regulations provide guidance on how to implement the law. This law secures new privacy rights for California consumers, including:

• The right to know about the personal information a business collects about them and how it is used and shared;
• The right to delete personal information collected from them (with some exceptions);
• The right to opt-out of the sale of their personal information; and
• The right to non-discrimination for exercising their CCPA rights.

Businesses are required to give consumers certain notices explaining their privacy practices. The CCPA applies to many businesses, including data brokers.

California Privacy Rights Act (CPRA) of 2020 

• Modified the CCPA (above) when approved via ballot initiative Proposition 24 in November 2020.
• Creation of a new California Privacy Protection Agency. 
• The key provisions of the CPRA will NOT go into effect until January 1, 2023.

Colorado State Law:

Colorado SB 190 , the Protect Personal Data Privacy Act, was signed into law on July 7, 2021, and took effect on July 1, 2023. Major provisions include: 

• Enable a consumer to opt-out of the processing of their personal information. 
• Confirm whether or not a controller is processing personal data concerning the consumer and to provide access to that information. 
• The right to correct inaccurate personal information. 
• The right to have personal information deleted.
• Controllers would be required to provide a meaningful privacy notice to consumers detailing their various rights
• Does not contain a private right of action.

Nonprofit organizations are NOT exempted from the requirements of the law.

Notes:

• The statute does not prescribe fundraising, but unlike other states, registering to solicit in the state is considered “doing business” in Colorado.
• To fall under the jurisdiction of the statute, an organization must have personal data on 100,000 or more Coloradans; or receive revenue or discounts from the sale of data (e.g., list rental and exchange) and have data for 25,000 or more Coloradans.

Connecticut State Law:

Connecticut SB 6/Public Act 22-15, sponsored by Senate President Pro Tempore Martin Looney, D-New Haven, was signed on May 10, 2022, and took effect on July 1, 2023. The law grants consumers various rights including:

• The right to confirm whether or not a controller is processing the consumer’s personal data.
• The right to correct inaccuracies in their personal data.
• The right to delete personal data provided by or obtained about the consumer.
• The right to obtain a copy of the consumer’s personal data processed by the controller.
• The right to opt out of the processing of the personal data for the purposes of targeted advertising, the sale of personal data or profiling in furtherance of decisions that produce legal or similarly significant effects.

Controllers will be required to respond to verified consumer requests within 45 days but could request an extension of an additional 45 days. Controllers will also be prohibited from processing the sensitive data of a consumer without their affirmative consent. The law will not apply to nonprofit organizations, does not provide a private right of action and will grant controllers a right to cure at the discretion of the attorney general. The law will also specify that a controller is not required to authenticate an opt-out request but will be able to deny a request if the controller has reasonable and documented belief that the request is fraudulent. Controllers will be required to send notice to the person making the request that they believe the request is fraudulent.

Utah State Law:

Utah SB 227 was signed March 24, 2022, and took effect on December 31, 2023. The law grants consumer’s various rights including:

• The right to confirm whether a controller is processing the consumer’s personal data and to access their data.
• The right to correct inaccurate personal data.
• The right to delete the consumer’s personal data.
• The right to obtain their personal data in an easily portable format.
• The right to opt-out of the processing of their data for the purposes of targeted advertising or the sale of personal data.

The law does not apply to nonprofit organizations and does not contain a private right of action.

Virginia State Law:

Virginia SB 1392, the Virginia Consumer Data Protection Act, was signed into law on March 2, 2021, and took effect on January 1, 2023.  The CDPA grants consumers the right to confirm, correct, and delete personal data and opt-out of use of data for advertising or sale.  It includes an opt-in consent requirement for sensitive data.  Nonprofits are largely exempt.

Other States

Other states have considered their own new state privacy statutes over the past few years, risking the creation of a “patchwork quilt” of varying, and often conflicting, state privacy laws. 

Click here for more information about privacy legislation being proposed in state legislatures.