Consumer privacy rules reach beyond California

Think your finance office isn't subject to California's sweeping new data privacy law because your dealership is, well, not in California?

Think again.

Any dealership that serves California residents could be regulated under the California Consumer Privacy Act, which takes effect Jan. 1. And lawmakers in several other states are considering legislation to give consumers more control over a business' ability to keep and share their personal information.

Over the next 12 months or so, statehouses, rather than Washington, are expected to be the epicenter of the debate over consumer data privacy, several lawyers and compliance experts told Automotive News — a response to highly publicized data breaches and complaints that big tech firms, such as Facebook, have mishandled users' information.

Multiple experts said they expect inaction in Washington in the near future as the U.S. heads into a presidential election year, and because a deeply polarized Congress hasn't settled on what a federal privacy policy should look like.

Lawyers who specialize in data security said they ultimately expect the federal government to intervene — especially if the result is a patchwork of rules that vary by state — though when is unclear.

Meanwhile, the Federal Trade Commission is weighing whether to adopt more stringent requirements to the Safeguards Rule, a provision of the federal Gramm-Leach-Bliley Act that requires financial institutions to protect consumers' private information. Dealerships are subject to the rule because they provide customer financing.

Regulatory activity involving data privacy and security in the U.S. is only going to accelerate, experts said, so it behooves dealers to take proactive steps to review and update their data practices.

"I would expect that we're going to see continued pushes across the country, particularly in states that have any kind of [citizen] initiative process," said Monica Baumann, regulatory counsel with Scali Rasmussen in Sacramento, Calif., a law firm that represents auto dealers.

Legislators from New York to Nevada have taken up data privacy bills, though many of those stalled this year. Lawyers who track state data legislation say that may be a sign that lawmakers are taking a wait-and-see approach until California's law takes effect.

"The fact that you didn't see a lot of states move [bills] this year doesn't mean they're not going to move," said Lindsey Tonsager, a partner at Covington & Burling in San Francisco, who co-leads the firm's global privacy and cybersecurity practice group.

New York state Sen. Kevin Thomas, a Democrat from Nassau County, said he is gathering input to revise and reintroduce a bill to create the New York Privacy Act in 2020. "There needs to be some oversight," he said.

The bill as written this year would have required a business that holds a consumer's personal information to act as a "data fiduciary," operating in the best interest of the consumer even if that supersedes the business' duty to its owners and shareholders. Thomas called the provision a "duty of loyalty" to consumers.

Businesses "need to balance both, and they can do it. Privacy isn't something," he said, that "they're going to lose money over."

He added, "Having adequate privacy [controls] will only allow them to sell a better product, and consumers will flock to them even more knowing that this company is taking more steps to protect the data that I'm giving them."

In Massachusetts, a pending data privacy bill also would allow consumers to request that a business delete their data. Businesses that have more than $10 million in annual gross revenue or make at least half of their annual revenue from sharing customer data with third parties would be subject to the law, according to the draft legislation.

The bill raises concerns that dealerships wouldn't be able to access or share information to properly service a customer's vehicle, said Robert O'Koniewski, executive vice president of the Massachusetts State Automobile Dealers Association, which opposes the bill.

Once data is created, "I just don't know how you rewind that clock back to give people a situation where data's not out there," he said.

Nevada's law, which took effect in October, prohibits the sale of a customer's data at the customer's request. But it exempts financial institutions subject to the federal Gramm-Leach-Bliley Act, as well as automakers and "a person who repairs or services a motor vehicle" who collects data related to a technology or service on the vehicle.

That's likely to exempt auto dealers, said Andy MacKay, executive director of the Nevada Franchised Auto Dealers Association. But that doesn't mean his members are off the hook.

MacKay said dealers in his state are more concerned about neighboring California's law, since many dealers count California residents as customers. The California Consumer Privacy Act defines a consumer as a California resident, and several lawyers say that definition could mean dealerships in other states are bound by the new rules — though it's still unclear to what extent.

Businesses required to comply with California's law are those that have more than $25 million in gross annual revenue; buy, sell or share personal data of at least 50,000 consumers, households or devices; and/or earn at least half of their annual revenue from the sale of consumer data.

"If you really have any real line of business in California, you need to be prepared to comply with it," MacKay said he tells Nevada dealers.

Several compliance experts say the first step dealerships should take is to map out the data they collect, including the source of the information, where it's stored and with whom it's shared. That is applicable, experts say, to dealers in all states.

"Unless you know those fundamentals, it's going to be very difficult to come into compliance, regardless of what the specifics of the law says," Tonsager said.

That process includes working with third-party vendors on securing data shared with dealers. Dealers should look at their vendor contracts to make sure that they include safeguards to protect consumers' information, and vet prospective vendors about their security practices, said Spurti Kanekar, who leads compliance for dealership technology company CarGurus Inc. She spoke to Automotive News at the company's Navigate automotive conference in October.

Additionally, dealers that might be subject to California's law should consider how they would allow a consumer to make a data-related request, such as via email or a Web form, and how they'll process the requests, said Phil Yannella, practice leader of the privacy and data security group at Ballard Spahr in Philadelphia.

"Companies are really gearing up to create these infrastructures that are capable of handling a lot of [consumer] requests like that," he said, "but no one knows if we're really going to see a lot of requests."