Virginia Passes Legislation Prohibiting the Use of Employees’ Social Security Numbers as Identifiers | Workplace Privacy, Data Management & Security Report
Workplace Privacy, Data Management & Security Report
Virginia Passes Legislation Prohibiting the Use of Employees’ Social Security Numbers as Identifiers
By Jason C. Gavejian & Joseph J. Lazzarotti on April 19, 2023
POSTED IN WORKPLACE PRIVACY
On March 21, 2023, Virginia’s governor approved Senate Bill 1040, which prohibits an employer from using an employee’s social security number or any derivative as an employee’s identification number. The bill also prohibits including an employee’s social security number or any number derived from the social security number on any identification card or badge.
An employer who knowingly violates the new law may be subject to a civil penalty not to exceed $100 for each violation. However, the employer shall be provided notice of the violation by the state Commissioner and the employer can request an informal conference regarding the violation.
The bill takes effect on July 1, 2023.
Virginia joins other states with similar prohibitions such as in New York and under federal law.
If you have questions about Virginia’s bill or the protection of employees’ social security numbers, contact a Jackson Lewis attorney to discuss.
Email this postTweet this postLike this postShare this post on LinkedIn
Indiana To Be Next in Passing Consumer Privacy Statute
By Joseph J. Lazzarotti, Dorothy Parson McDermott & Cheyna Galloway on April 17, 2023
POSTED IN CONSUMER PRIVACY
The Indiana Legislature is poised to pass Senate Bill 5, a comprehensive privacy statute (the “Act”), and send it on to the Governor. Once signed, the Act will become operative on January 1, 2026, and make Indiana the seventh state, after California, Colorado, Connecticut, Iowa, Utah, and Virginia to enact a comprehensive consumer privacy statute.
Key Elements
Similar to the Colorado Privacy Act (CPA) and the Virginia Consumer Data Privacy Act (VCDPA), the Act was modeled in part on the CCPA, CPRA, and the EU General Data Protection Regulation (GDPR). But there are some variations. Key elements of the UCPA include:
When does the Act apply? The Act applies to persons that conduct business in Indiana or produce products or services that are targeted to residents of the state and that, during a calendar year:
Control or process personal data of at least 100,000 consumers who are residents of the state, or
Control or process personal data of at least 25,000 consumers who are residents of the state and derive more than 50% of gross revenue from the sale of personal data.
Are there exemptions? Among the persons not subject to the Act include Indiana and state agencies, third-party contractors of the state and such agencies acting on their behalf (but only with respect to such contracts), financial institutions, HIPAA-covered entities and business associates, not-for-profit organizations, institutions of higher education, and public utilities.
Who is protected under the Act? The Act protects the personal information of a “consumer,” defined as an individual who:
Is a resident of the state, and
Is acting only for personal, family, or household purposes.
Like the recently passed Iowa statute, Indiana excludes individuals acting in a commercial or employment context from its definition of consumer.
What “personal data” is protected under the Act? Under the Act, personal data is defined broadly as information that is linked or reasonably linkable to an individual. The definition excludes de-identified data, aggregate data, or publicly available information.
What rights do consumers have under the Act? The Act provides consumers with the following rights:
The right to request confirmation of whether a business is processing their personal data and related information.
The right to access their personal data upon request.
The right to correct information a company possesses
The right to delete personal information obtained by businesses
The right to opt out of the processing of personal data for purposes of targeted advertising, sale of personal data, or certain profiling activities.
The rules surrounding the administration of these rights pull from similar language in the other state privacy laws – a 45-day period to respond, a verification requirement, and a right to appeal a controller’s adverse decision concerning a consumer right request.
What obligations do covered persons have?
The Act lays out a list of obligations for controllers which generally track the laws in the other states. Without limitation, controllers must:
limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed,
establish, implement, and maintain reasonable administrative, technical, and physical security practices to protect the confidentiality, integrity, and accessibility of personal data,
not discriminate against a consumer for exercising rights under the Act,
not process sensitive data without the consumer’s consent,
provide consumer with a privacy notice that explained among other things the categories of personal data the controller processes and shares with third parties, and
provide consumers the opportunity to opt out of the sale of personal data and explain the means to exercise these and other rights under the Act.
For processing activities created or generated after December 31, 2025, controllers need to conduct and document impact assessments for certain processing activities, such as the sale of personal data and the processing of sensitive data. In short, these assessments must weigh the benefits of the processing and the risks to the consumer, considering risk mitigation efforts by the controller.
With respect to processors, the Act requires they adhere to the instructions of controllers, such as assisting the controller with responding to consumer requests. Contracts between controllers and processors must include certain provisions, such as instructions for processing personal data, the nature and duration of the processing. Other required provisions include (i) a requirement for processors to make available all information in the processor’s possession to demonstrate the processor’s compliance with the Act, (ii) cooperating with reasonable assessments of compliance by the controller (or arrange for a qualified and independent assessor), and (iii) obligating the processor to push the Act’s required provisions down to the processor’s subcontractors
How is the law enforced, any private right of action? Unlike the CCPA, Indiana’s statute does not include a private right of action for consumers. In fact, the Act states that “[n]othing in [the Act] shall be construed as providing the basis for a private right of action for violations of this article or any other law.” Instead, the state attorney general will have exclusive enforcement authority. Businesses that are found to have violated the law may face fines of up to $7,500 per violation.
For additional information on Indiana’s new privacy statute and other data privacy laws and regulations, please reach out to a member of our Privacy, Data, and Cybersecurity practice group.
Virginia Passes Legislation Prohibiting the Use of Employees’ Social Security Numbers as Identifiers
By Jason C. Gavejian & Joseph J. Lazzarotti on April 19, 2023
POSTED IN WORKPLACE PRIVACY
On March 21, 2023, Virginia’s governor approved Senate Bill 1040, which prohibits an employer from using an employee’s social security number or any derivative as an employee’s identification number. The bill also prohibits including an employee’s social security number or any number derived from the social security number on any identification card or badge.
An employer who knowingly violates the new law may be subject to a civil penalty not to exceed $100 for each violation. However, the employer shall be provided notice of the violation by the state Commissioner and the employer can request an informal conference regarding the violation.
The bill takes effect on July 1, 2023.
Virginia joins other states with similar prohibitions such as in New York and under federal law.
If you have questions about Virginia’s bill or the protection of employees’ social security numbers, contact a Jackson Lewis attorney to discuss.
Email this postTweet this postLike this postShare this post on LinkedIn
Indiana To Be Next in Passing Consumer Privacy Statute
By Joseph J. Lazzarotti, Dorothy Parson McDermott & Cheyna Galloway on April 17, 2023
POSTED IN CONSUMER PRIVACY
The Indiana Legislature is poised to pass Senate Bill 5, a comprehensive privacy statute (the “Act”), and send it on to the Governor. Once signed, the Act will become operative on January 1, 2026, and make Indiana the seventh state, after California, Colorado, Connecticut, Iowa, Utah, and Virginia to enact a comprehensive consumer privacy statute.
Key Elements
Similar to the Colorado Privacy Act (CPA) and the Virginia Consumer Data Privacy Act (VCDPA), the Act was modeled in part on the CCPA, CPRA, and the EU General Data Protection Regulation (GDPR). But there are some variations. Key elements of the UCPA include:
When does the Act apply? The Act applies to persons that conduct business in Indiana or produce products or services that are targeted to residents of the state and that, during a calendar year:
Control or process personal data of at least 100,000 consumers who are residents of the state, or
Control or process personal data of at least 25,000 consumers who are residents of the state and derive more than 50% of gross revenue from the sale of personal data.
Are there exemptions? Among the persons not subject to the Act include Indiana and state agencies, third-party contractors of the state and such agencies acting on their behalf (but only with respect to such contracts), financial institutions, HIPAA-covered entities and business associates, not-for-profit organizations, institutions of higher education, and public utilities.
Who is protected under the Act? The Act protects the personal information of a “consumer,” defined as an individual who:
Is a resident of the state, and
Is acting only for personal, family, or household purposes.
Like the recently passed Iowa statute, Indiana excludes individuals acting in a commercial or employment context from its definition of consumer.
What “personal data” is protected under the Act? Under the Act, personal data is defined broadly as information that is linked or reasonably linkable to an individual. The definition excludes de-identified data, aggregate data, or publicly available information.
What rights do consumers have under the Act? The Act provides consumers with the following rights:
The right to request confirmation of whether a business is processing their personal data and related information.
The right to access their personal data upon request.
The right to correct information a company possesses
The right to delete personal information obtained by businesses
The right to opt out of the processing of personal data for purposes of targeted advertising, sale of personal data, or certain profiling activities.
The rules surrounding the administration of these rights pull from similar language in the other state privacy laws – a 45-day period to respond, a verification requirement, and a right to appeal a controller’s adverse decision concerning a consumer right request.
What obligations do covered persons have?
The Act lays out a list of obligations for controllers which generally track the laws in the other states. Without limitation, controllers must:
limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed,
establish, implement, and maintain reasonable administrative, technical, and physical security practices to protect the confidentiality, integrity, and accessibility of personal data,
not discriminate against a consumer for exercising rights under the Act,
not process sensitive data without the consumer’s consent,
provide consumer with a privacy notice that explained among other things the categories of personal data the controller processes and shares with third parties, and
provide consumers the opportunity to opt out of the sale of personal data and explain the means to exercise these and other rights under the Act.
For processing activities created or generated after December 31, 2025, controllers need to conduct and document impact assessments for certain processing activities, such as the sale of personal data and the processing of sensitive data. In short, these assessments must weigh the benefits of the processing and the risks to the consumer, considering risk mitigation efforts by the controller.
With respect to processors, the Act requires they adhere to the instructions of controllers, such as assisting the controller with responding to consumer requests. Contracts between controllers and processors must include certain provisions, such as instructions for processing personal data, the nature and duration of the processing. Other required provisions include (i) a requirement for processors to make available all information in the processor’s possession to demonstrate the processor’s compliance with the Act, (ii) cooperating with reasonable assessments of compliance by the controller (or arrange for a qualified and independent assessor), and (iii) obligating the processor to push the Act’s required provisions down to the processor’s subcontractors
How is the law enforced, any private right of action? Unlike the CCPA, Indiana’s statute does not include a private right of action for consumers. In fact, the Act states that “[n]othing in [the Act] shall be construed as providing the basis for a private right of action for violations of this article or any other law.” Instead, the state attorney general will have exclusive enforcement authority. Businesses that are found to have violated the law may face fines of up to $7,500 per violation.
For additional information on Indiana’s new privacy statute and other data privacy laws and regulations, please reach out to a member of our Privacy, Data, and Cybersecurity practice group.
