Customer Privacy Laws Get Tougher, State by State

Growing consumer demand for increased privacy has spurred lawmakers in several states to pass tougher laws similar in tone to the European General Data Protection Regulation (GDPR).

If your state is among them, these laws have a significant impact on how dealerships may collect, store and share personal customer data.

Recent legislation includes:

If your state is not among those listed, just wait. Similar state laws will soon follow. It’s up to business owners to keep abreast and be proactive about staying compliant. The requirements to stay in compliance vary quite a bit, depending on the state and the law.

The CCPA applies not only to dealerships in California, but also to outside third parties. This means automakers, dealership management software (DMS) vendors, CRM providers, marketers and any other entity with which dealers share their customers’ personal information must also comply.

In a nutshell, the CCPA requires businesses to take “reasonable measures” to protect consumer data such as names, addresses, social security numbers, bank account numbers, credit card numbers and credit scores.

The act uses the word “consumer” rather than the more narrowly defined “customer.” That means the same protections must be afforded to every person in a dealership database regardless of whether they were ever a customer.

The California Attorney General has defined reasonable measures as compliance with 20 controls established by the Center for Internet Security. For most dealers, this will require upgrades to software, hardware and data security equipment.

As examples, here are short summaries of five of the 20 controls that California dealerships and their third-party vendors will be required to implement:

The Washington Privacy Act is similar to the CCPA, with language that closely resembles the European GDPR.

Both acts give more rights to consumers related to how a business may collect and use their information. Once the laws take effect, upon a request from a consumer, dealers will be required to:

You’ll also be required to proactively provide full disclosure to consumers about what their data is used for, who it is shared with and for what purpose, at the time said data is collected.

Businesses will also be required to post a “Do Not Sell My Personal Information” link on the home page of their websites.

Violation of these acts will result in a $2,500 fine per violation, $7,500 per intentional violation. These laws open dealerships to potential litigation from consumers in the event it is discovered the dealers did not “implement and maintain reasonable security procedures and practices.”

The updated data-breach notification laws (2.0 Laws) aren’t quite as comprehensive as the Washington and California Privacy Acts, and vary from state to state.

However, the requirements will force dealerships to be more proactive about securing customer data. For example, Alabama’s law lists the following requirements:

In coming years, compliance with new consumer privacy and data security laws will likely become a dealership top priority. This will require dealer principals and senior management to become informed, know the legal requirements and explore cost-effective ways to stay compliant.

Erik Nachbahr is president and founder of Helion Technologies, a dealership information-technology provider.