What to Expect in 2023: Trends in Cybersecurity & Data Privacy

The New Year is in full swing and it’s time to consider the top trends in cybersecurity & data privacy our team expects to see throughout 2023. It will be an exciting year due to the myriad of new laws coming into effect, and organizations will need to update their global cybersecurity & data privacy programs accordingly. Whether at a state, federal, or international level, these developments are likely to impact businesses in every industry over the coming months:

State Consumer Privacy Laws

California, Virginia, Colorado, Connecticut, and Utah are the five states that have enacted comprehensive consumer privacy laws. The California Privacy Rights Act (CPRA) and the Virginia Consumer Data Protection Act (VCDPA) went into effect January 1, and Colorado, Connecticut, and Utah go into effect later this year.

Although the CPRA is already in effect, the initial set of its regulations are not set to be finalized until April 2023. Further, the current regulations do not include regulations related to artificial intelligence (AI), cybersecurity audits, or privacy risk assessments, and the California Privacy Protection Agency (CPPA) recently commenced the rulemaking process on these topics. Additionally, the CPRA is currently the only law that applies to employment and business-to-business information as the CPPA has not indicated that it plans to extend the partial and temporary exception from the California Consumer Privacy Act (CCPA).

Colorado is the only other state to issue regulations related to its consumer privacy law. The Colorado Attorney General recently issued proposed regulations on the Consumer Privacy Act (CPA) and will begin holding stakeholder sessions in 2023. Although the CPA does not go into effect until July 1, organizations should begin assessing how the CPA and the proposed regulations will affect their overall privacy program.

Many other states are also considering adopting comprehensive consumer privacy laws so organizations will need to continually adapt their data privacy programs. Namely, organizations should map out what personal data they use, how they collect it, who has access to it, and where it is stored. In particular, organizations will need to assess if their use of data and advertising practices meet these new requirements. Organizations should also review privacy policies and related notice at collection to ensure the necessary information is disclosed to consumers, employees/applicants, and business-to-business contacts, if applicable. Due to the fact the laws are in flux, organizations should also monitor developments in state legislatures and other applicable global jurisdictions.

Regulations Related to AI and Automated Processing

In 2023, organizations will be subject to new AI and automated processing related obligations under four new state consumer privacy laws. While organizations subject to the General Data Protection Regulation (GDPR) are likely familiar with the law’s requirements related to AI and automated processing, the regulatory landscape in the U.S. remains uncertain and it is unclear whether there will be meaningful overlap between GDPR and state privacy laws. New consumer privacy laws in California, Colorado, Connecticut, and Virginia have AI/automated processing-related requirements, such as impact assessments on high-risk processing and opt-out rights, but questions remain on how states will address consumer harms and right to delete requests, and what type of information organizations should provide to consumers related to automated processing. Over the course of the year, organizations that use AI or automated processing technology should be mindful that new requirements are likely to emerge as California’s rulemaking process is in progress and Colorado has issued proposed regulations.

Children’s Privacy

The government remains focused on children’s privacy. California recently enacted the California Age-Appropriate Design Code Act (CAADCA), which takes effect July 1, 2024. The CAADCA intends to protect the wellbeing, data, and privacy of children using online platforms and is modeled after the Age Appropriate Design Code recently enacted in the United Kingdom. On the federal level, the Federal Trade Commission (FTC) continues to aggressively enforce the Children’s Online Privacy Protection Act (COPPA) by issuing hefty fines. Companies with online services directed to children or that have reason to know that children under the age of 13 use their services should ensure compliance with COPPA and state laws.

EU-U.S. Data Privacy Framework

The EU and the U.S. agreed on a data transfer regime last year and the EU recently issued its draft adequacy decision on the EU-U.S. Data Privacy Framework (DPF). The draft adequacy decision, if adopted, establishes that the U.S. offers appropriate safeguards to EU consumers and ensures the adequate level of protection for personal data transferred from the EU to organizations in the U.S. Although the DPF has been praised by EU and U.S. officials, EU regulators are already planning a challenge as they believe it falls short of the level of protection required by the GDPR.

Escalated Enforcement Actions and Litigation

2022 marked the first enforcement of the California Consumer Privacy Act (CCPA), and the expectation is that both domestic and international regulators will be increasing their efforts to identify and bring enforcement actions against entities they perceive as violating data privacy and security laws.

At the same time, the EU Advocate General provided guidance that data subjects are not automatically owed compensation for technical violations of the GDPR without material or non-material damage, and instead can only be compensated for actual harm. This may reduce private claims under the GDPR.

Cybersecurity Programs and Incident Response Plans

Cybersecurity remains a top priority for organizations as cyberattacks, including ransomware and cyber extortion, continue to increase year-over-year. According to the Verizon Data Breach Investigation Report, ransomware attacks increased 13% last year and will likely increase in 2023. Even the largest, most sophisticated organizations can be victims of data breaches as a result of cyberattacks. As such, organizations should proactively monitor risks and update their cybersecurity programs and incident response plans to defend against and efficiently respond to cyberattacks.

There is a myriad of new proposed laws on the horizon for this year, such as the New York Department of Financial Services (NYDFS) cybersecurity regulation, the Securities and Exchange Commission (SEC) cybersecurity disclosure requirements for public companies, and the Cybersecurity Incident Reporting for Critical Infrastructure Act (CISA) that could come into effect. As such, organizations should keep their eyes on these developments as they build their cybersecurity programs and incident response plans.

State Data Breach Notification Laws

In addition, state data breach notification laws are continually evolving with new and different requirements. Organizations must make it a priority to monitor these changes to understand their obligations in the event of a data breach and update their incident response plans accordingly. To learn more about state data breach notification laws and developments, please access Foley’s state data breach notification chart here.

For more information about complying with cybersecurity & data privacy laws and building an effective program, please contact any Partner or Senior Counsel in Foley’s Cybersecurity and Data Privacy Team.

Disclaimer

This blog is made available by Foley & Lardner LLP (“Foley” or “the Firm”) for informational purposes only. It is not meant to convey the Firm’s legal position on behalf of any client, nor is it intended to convey specific legal advice. Any opinions expressed in this article do not necessarily reflect the views of Foley & Lardner LLP, its partners, or its clients. Accordingly, do not act upon this information without seeking counsel from a licensed attorney. This blog is not intended to create, and receipt of it does not constitute, an attorney-client relationship. Communicating with Foley through this website by email, blog post, or otherwise, does not create an attorney-client relationship for any legal matter. Therefore, any communication or material you transmit to Foley through this blog, whether by email, blog post or any other manner, will not be treated as confidential or proprietary. The information on this blog is published “AS IS” and is not guaranteed to be complete, accurate, and or up-to-date. Foley makes no representations or warranties of any kind, express or implied, as to the operation or content of the site. Foley expressly disclaims all other guarantees, warranties, conditions and representations of any kind, either express or implied, whether arising under any statute, law, commercial use or otherwise, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Foley or any of its partners, officers, employees, agents or affiliates be liable, directly or indirectly, under any theory of law (contract, tort, negligence or otherwise), to you or anyone else, for any claims, losses or damages, direct, indirect special, incidental, punitive or consequential, resulting from or occasioned by the creation, use of or reliance on this site (including information and other content) or any third party websites or the information, resources or material accessed through any such websites. In some jurisdictions, the contents of this blog may be considered Attorney Advertising. If applicable, please note that prior results do not guarantee a similar outcome. Photographs are for dramatization purposes only and may include models. Likenesses do not necessarily imply current client, partnership or employee status.