Data privacy management is the system that a business or another entity uses to ensure the privacy and safety of the data it collects in the course of its operations. Data privacy management would involve an organization’s privacy framework and the tools it employs to protect their customers’ right to privacy. A data privacy management system would also include features to educate and inform customers and allow them to control their data.
Importantly, it would also have to comply with all applicable Ohio and federal laws and regulations that govern how businesses collect, use, store, share and sometimes sell the data they collect from consumers.
The concern that consumers have is that their data can be shared with bad actors and criminals, making them subject to identity theft and other types of theft and consumer fraud.
Currently there is no comprehensive privacy law in Ohio. The Ohio Personal Privacy Act (OPPA) has been proposed, but has not been adopted. Therefore, businesses must stay up to date with and obey other existing state and federal laws.
Among the Ohio laws now in effect that protect the privacy of consumer data are the following:
- Credit Card Recording Act: This act bans businesses from distributing the sensitive financial data of consumers for marketing purposes. Among the sensitive data it protects are Social Security numbers and full credit card details. Businesses are allowed only the right to store the information for purposes that do not involve marketing.
- Credit Card Truncation Act: This act requires businesses to list only five numbers of a consumer’s credit or debit card number on a purchase receipt. It also prohibits entities from including the card’s expiration date on a receipt.
- Ohio Data Protection Act (ODPA): This law does not require businesses to employ rigorous cybersecurity practices to protect sensitive consumer data from data breaches.
- It does provide an affirmative legal defense to companies that do this in the event they are sued by a customer for their failure to protect their personal data from a data breach.
- The Ohio Security Breach Notification Act: It requires organizations to notify consumers who have been the victims of a data breach within 45 days of discovering a breach that involves their personal or sensitive information.
- Entities are allowed the choice of mailing, emailing, or telephoning individuals to tell them of the breach. If a breach affects over 1,000 Ohio residents, the three credit reporting agencies, Experian, Equifax and TransUnion, must be notified as well.
Ohio recognizes certain cybersecurity frameworks as sufficient to provide them with a valid legal defense in any lawsuit alleging poor information security controls if they adopt and maintain compliance with their standards. They are:
- The National Institute of Standards and Technology (NIST)
- The Center for Internet Security Controls (CIS)
- The Payment Card Industry Data Security Standard (PCI DSS).
If an organization can prove that it complied with the relevant standards, it can defeat civil liability in Ohio’s state courts. The Ohio law requires courts to consider an organization’s size, complexity, and resources when determining whether it has complied as necessary.
An Ohio lawyer consultation would help a person understand the complexity of data privacy laws in that state. It would help a business with compliance with legal requirements. It would also help an individual understand their rights.
There are also several federal laws that provide consumers with privacy protections as follows:
- Health Insurance Portability and Accountability Act (HIPAA): This federal law applies to businesses in the healthcare industry that deal with the Protected Health Information (PHI) of individuals. These businesses must comply with the HIPAA nationwide and protect people’s private medical information.
- Children’s Online Privacy Protection Act (COPPA): This federal law focuses mainly on protecting the personal data of minors and the sensitive personal data of minors under 13 years of age across the US. Hence, businesses that collect and manage the data of minors must use practices that comply with COPPA.
- Gramm-Leach-Bliley Act (GLBA): Businesses that operate in the financial industry may have to comply with the GLBA. The GLBA requires financial institutions to inform customers about their data-sharing practices. They must also protect their customers’ sensitive information.
- Fair Credit Reporting Act (FCRA): The FCRA governs consumer credit reporting. It requires businesses to ensure that credit data is accurate and secure.
Of course, the Fourth Amendment to the U.S. Constitution promises individuals in the U.S. the right “to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures.”
Courts have interpreted the 4th Amendment to give Americans a reasonable expectation of privacy in such domains as their places of residence and certain areas of their vehicles. It has also been interpreted to extend to electronic data and digital privacy, the information and data that people generate through such technologies as cell phones, email and wearable devices.
Generally, the government needs a warrant to access a person’s private personal digital information.
However, the 4th Amendment applies only to governments and does not constrain private entities, e.g. private businesses. Federal and state laws must be used to give people the protection they need in the private sector.
