Think your finance office isn't subject to California's sweeping new data privacy law because your dealership is, well, not in California?
Any dealership that serves California residents could be regulated under the California Consumer Privacy Act, which takes effect Jan. 1. And lawmakers in several other states are considering legislation to give consumers more control over a business' ability to keep and share their personal information.
Over the next 12 months or so, statehouses, rather than Washington, are expected to be the epicenter of the debate over consumer data privacy, several lawyers and compliance experts told Automotive News — a response to highly publicized data breaches and complaints that big tech firms, such as Facebook, have mishandled users' information.
Lawyers who specialize in data security said they ultimately expect the federal government to intervene — especially if the result is a patchwork of rules that vary by state — though when is unclear.
Meanwhile, the Federal Trade Commission is weighing whether to adopt more stringent requirements to the Safeguards Rule, a provision of the federal Gramm-Leach-Bliley Act that requires financial institutions to protect consumers' private information. Dealerships are subject to the rule because they provide customer financing.