Privacy & Data: Internal Security Compliance >> Data Security Legislation Is On The Rise — Marketers And Their Agencies Must Be Vigilant About Their Controls

2018 saw a surge of state data security legislation, including by Alabama, Arizona, California, Colorado, Iowa, Louisiana, Nebraska, Ohio, Oregon, South Carolina, South Dakota, Vermont and Virginia. These laws are intended to enhance and strengthen existing data protection guidelines and, in some cases, are modeled after existing standards, such as the European Union's General Data Protection Regulation. These new (or amended) regulations set minimum data security requirements and practices for businesses that collect and process personal data. Additionally, they identify breach notification time periods, broaden the definitions of "personal information" and add safeguards with regard to the information of minors. Other notable changes include, in the case of Colorado and Nebraska, requirements to flow down appropriate security measures to service providers receiving personal information.