Earlier this month, Connecticut became the fifth state to pass a comprehensive data privacy law aimed at protecting consumers’ personal information. Many attorneys, like general counsel and class action litigators, are likely aware of the implications these laws will have for their legal work. But as more and more jurisdictions enact data privacy legislation, every lawyer should understand these laws and the ways they may affect the ediscovery process.

For example, in anticipation of new data privacy restrictions, legal teams in both Canada and California have begun searching for ediscovery tools that host data within their respective regions. Even if laws like these have not yet reached your jurisdiction, attorneys should stay up-to-date with new developments and know what steps their ediscovery provider has taken to help clients meet these new requirements.

Data Privacy Laws Explained

Conversations about data privacy are not limited to law and politics. We hear questions about our data everywhere we turn: Is Facebook tracking each click we make? Is your iPhone listening to your conversations? And when companies do track our data, what do they do with it?

New data privacy laws aim to answer questions like these, providing transparency and giving users control over their data. The European Union enacted the General Data Protection Regulation (GDPR) in 2018, which tightened restrictions on data privacy and levied harsher penalties for companies that violate the new rules. It was groundbreaking in its approach to data protection, and it remains the toughest privacy and security law in the world.

Soon after, other governments like Brazil and South Africa followed suit with similar laws; California was the first jurisdiction in the United States to tread into the territory of harsher data privacy restrictions. First, California passed the California Consumer Privacy Act (CCPA) in 2018, which established specific privacy rights for consumers.

These include the right to know what information businesses have collected about you, why they collected it, and what they used it for; the right to delete personal information that businesses have collected (with exceptions); the right to opt-out of the sale of personal information; and the right to non-discrimination for consumers who choose to exercise their rights under the CCPA.

In November 2020, California passed the California Privacy Rights Act (CPRA), which will go into effect next year. This expansion to the CCPA adds additional consumer rights, including the right to correct inaccurate information and rights involving the use of automated decision-making technology.

Days after the California legislature passed the CPRA, the Canadian government announced a plan to enact a similar law – the Canadian Consumer Privacy Protection Act (CPPA). Bill C-11, as it’s currently known, centers consent from consumers on the collection and distribution of their data, requires transparency about the use of artificial intelligence and other algorithms, and lays out a framework for enforcement under the federal privacy commissioner.

Colorado, Virginia, Utah, and Connecticut have passed similar laws, though none as far-reaching as California’s. Even more states have introduced data privacy bills; some died in committee, while others are still being debated.

What Does This Have to Do With Ediscovery?

With all this jargon about consumer rights to data privacy, you might be wondering how this ties back to your ediscovery process. After all, as a lawyer, you’re not collecting data for commercial purposes. You’ve always ensured the security of your clients’ data; if you continue to do so, why should these new restrictions affect you?

But these laws are unique in their wide scope and harsh penalties combined with a vague approach to the specifics. They have pushed boundaries in cracking down on data privacy, so any industry that deals with data needs to ensure compliance. And ediscovery is, at its core, about data.

As we see what these laws look like in practice, legal teams may need to make more adjustments to their ediscovery processes. We may see a greater push toward more localized data hosting, which is starting to occur in Canada and California. Or we may see totally different trends arise in this new landscape of laws for our digital world. The key to embracing these changes is to stay informed on new legislation and case law – and to choose an ediscovery provider that is proactive about helping you face any obstacles these standards present.