Introduction: A Deep Dive into Privacy

Aaron Kouhoupt: I am Aaron Kouhoupt, and I am a member in the Financial Services compliance group for McGlinchey Stafford. I am out of our Cleveland office, and I also serve as the Chief Privacy Officer for the firm.

David Tallman: I’m David Tallman. I’m also a member in our consumer financial services group out of our Houston office.

Aaron Kouhoupt: We’d like to welcome you to the next segment of the Deep Dive series that McGlinchey puts on. This time we will be talking about all things privacy, both on the federal and the state level, and also talking about both information data usage, sharing, and also information protection and data protection.

We are really excited for this privacy series. There is so much going on in the privacy world, both on the federal and state level, and it’s not slowing down, right? I mean, I think that both the federal and the state government over the last few years, really, have been focused on big data, focused on the use and sharing of consumer information because, I think, maybe more than ever, with the pandemic, we had a move to remote, and we had a move to interacting through social media and through electronic communication channels, and it really just sort of blew up. And you saw that with the reaction from, maybe in particular, the states, and I think that the states are taking a bigger lead here and enacting new laws that are covering data protection in a way that the Gramm-Leach-Bliley Act (GLBA) doesn’t.

On top of that, we have biometrics, and we have all of these other things that states are coming in and saying, “Be careful, provide disclosures, let people know.” And so there are a lot of sort of traps for the unwary out there. I would argue that if you’re involved in the financial services industry at all, no matter what department you’re in, no matter what your role is, data protection, data privacy, data usage is probably going to be primary on your minds. And that’s maybe especially true when it comes to bank partner programs and how you sort of navigate that very difficult data usage and data ownership problem. So those are the things that we’re going to talk about over the next few weeks.

David, I know there is just so much going on right now. What are some of the things that you think are going to be the most pressing in the next year or so?

David Tallman: There’s all sorts of fun stuff coming down the pike. As you suggest, at the state level, there’s a lot of activity. There’ll be a lot of focus, continued focus on California and the California Consumer Privacy Act and the rulemaking that’s going to be coming out under the CPRA. But California is now joined as of 2023 by other states, including Virginia, Colorado, and Utah. Some of these laws are now in effect, some will be coming into effect over the course of the year.

At the federal level, though, there is also going to be continued activity, not only implementation of the updated FTC safeguards rule on the Gramm-Leach-Bliley Act, but also potentially some new rules. The FTC put out an advanced notice of proposed rulemaking late last year on commercial surveillance and data security, indicating that it’s contemplating using its UDAAP authority to go after practices that it views to be unfair, deceptive, or abusive. Also, rulemaking from the SEC on cybersecurity and instant reporting and disclosure. There is also increased enforcement activity, both at the federal and state level. So it will be interesting to see how all of this plays out.

Aaron Kouhoupt: I’m glad you talked about the interplay with unfair and deceptive acts, because that’s something we’re going talk about in this series. And you’ve really seen that everywhere, right? The CFPB is starting to exercise or, is at least providing the framework, where they can use their unfair and deceptive acts powers to come in and look at these other areas, even if they might not directly apply to you, or if they’re somewhat in the middle, bank partner programs being an example again, where the unfair and deceptive acts authority is something that CFPB can come in and say, you know, we think that your data sharing practices are deceptive or unfair in some way, even if they’re not necessarily subject to or directly applicable to the underlying federal and state regulatory scheme.

David Tallman: And I think on the enforcement side of things, we will also continue to see regulators being aggressive and being creative in exercising their enforcement authority, because quite often they’ve got a great deal of latitude and flexibility. Just to give one example of something that I think is personally interesting is that you see consent orders roping in not only the company itself, but also control persons within the organization. There was an FTC consent order last year, a proposed order, where they not only required certain information security controls be implemented by the company, but they also required the CEO personally to implement similar controls at any subsequent company he may travel to in the future, which is something that’s happened before, but it’s rare. And I think there’s greater comfort now that the regulators are, you know, flexing their muscle.

Aaron Kouhoupt: We have got a lot to talk about over the next couple of months. As with all of our Deep Dive series, we’re going to be dropping content in written format, we’re going to have podcasts like this, we’re going to have some slightly more in-depth webinars, and then we will have a client-only session to end things off in a little while. So we’re excited to bring this to you, and if anybody has any questions, you can reach out to either David or I, and we look forward to the next couple of months.