US Privacy Law: The Shifting Definition of Sensitive Data

In the intricate realm of privacy law, a paradigm shift is currently underway in the United States. With no overarching federal framework dictating how businesses handle personal data, individual states are seizing the initiative to establish baseline privacy rights and protections. Since 2018, fourteen states have passed comprehensive privacy legislation aimed at safeguarding individuals' personal data.

One fundamental principle shared among these state laws is the recognition that certain categories of personal data entail heightened risks to individuals and therefore warrant greater levels of protection. These categories typically encompass demographic information, health status, biometric and genetic data, precise geolocation data, and information pertaining to children.

However, while these laws share common ground, they also exhibit nuanced differences, particularly in how they define and protect sensitive data. Recently enacted state privacy laws have expanded the definition of sensitive data in various directions, introducing new categories of information and broadening the scope of existing ones.

Protections for Sensitive Data

Navigating the landscape of sensitive data protection requires an understanding of the diverse approaches taken by different states. For instance, while some states mandate that individuals be provided with notice and the opportunity to opt out of the processing of their sensitive data, others require businesses to obtain explicit consent before collecting and processing such data.

California, a trailblazer in privacy legislation, introduced the California Privacy Rights Act, which includes elements inspired by European standards and incorporates categories such as information concerning union membership and philosophical beliefs. Texas, through the Texas Data Privacy and Security Act, expanded protections by adding individual "sexuality" as sensitive data. Oregon broadened the definition of personal data to include "derived" data and extended the scope of sensitive data to encompass categories like "status as transgender or nonbinary" and "status as a victim of a crime." Delaware became the first state to explicitly include "pregnancy" as covered health information, while New Jersey expanded protections by adding mental or physical health "treatment" to its definition of sensitive data.

Looking Ahead

The trajectory of US privacy law suggests that the definition of sensitive data will continue to evolve and expand. California is considering extending protections to children under 16 years of age, while Colorado aims to include "biological" data, explicitly recognizing "neural" data. Maine is contemplating incorporating the definition of sensitive data from the proposed federal American Data Privacy and Protection Act of 2022.

However, this expansion of sensitive data categories raises fundamental questions for privacy and data protection law. As technology advances, Professor Daniel Solove warns that nearly all personal data could be considered sensitive, posing challenges for policymakers. Solove suggests that policymakers may need to adopt a risk-based approach akin to Europe's GDPR, which focuses on assessing harm and risk rather than specific categories of data.

Another consideration is the potential for consent fatigue as consumers face increasing requests for consent to process sensitive data. The ultimate impact of these evolving privacy laws remains to be seen, but it is clear that the trend of expanding the concept of sensitive data shows no signs of slowing down.

In conclusion, the shifting landscape of US privacy law underscores the need for continuous adaptation and innovation in addressing the challenges posed by emerging technologies and evolving societal norms. As lawmakers grapple with the complexities of privacy regulation, the balance between protecting individuals' rights and fostering innovation will remain a central concern in shaping the future of privacy law in the United States.

Source: https://www.techpolicy.press/the-expanding-scope-of-sensitive-data-across-us-state-privacy-laws/