TAMPA, Fla.—It going to require “talent and tools” to comply with the wide range of new consumer privacy laws appearing both nationally and in states across the country, according to Trellance.
As CUToday.info has reported, credit unions are being encouraged to pay close attention to a plethora of consumer privacy laws either being updated or proposed in states across the U.S., the most concerning of which is the California Consumer Privacy Act (CCPA), which took effect in January, according to a number of analysts.
The CCPA, those analysts have explained, will have a big impact on businesses that handle consumer data. The CCPA is far reaching in its requirements, and does not just apply to credit unions headquartered in the Golden State. It also applies to any CU with a member in California.
The Act provides California residents with the right to:
- Know what personal data is being collected about them
- Know whether their personal data is sold or disclosed and to whom
- Say no to the sale of personal data
- Access their personal data
- Request a business to delete any personal information collected from a consumer
- Not be discriminated against for exercising their privacy rights
The concern, explained Trellance Chief Data Officer Carlos Caldera, is the interest the CCPA has spawned for new laws in other states that are expected to have the same impact as CCPA.
Compliance Scenarios
In a previous CUToday.info report, NAFCU noted, for example, that anyone who has a California residence and is telecommuting or working with the CU remotely would lead to compliance with CCPA. In another scenario, members who have moved to the Golden State and still do business with the credit union would place the CU under the new privacy rules.
“The impact of the CCPA, and all these laws, is very big among all credit unions,” Caldera said.
What can be most difficult to address, he said, is the variations in consumer privacy laws in states across the U.S.
“Without one federal law to guide us, compliance can be very time-consuming and costly,” Caldera said. “At least 25 states presented a bill or bill drafts in 2019. So, this is a pattern, and it's concerning—you can see each state is doing its own thing and nothing is coming out at the federal level. There is not a common framework of privacy laws from which credit unions can make decisions.”
Complicated Issue
To address any privacy law can be complicated, said Caldera.
“You not only have to protect members’ data, but you must also know the data that you have,” he said. “You have to know your data well enough to be able to act on it in the timeframe the laws are actually allowing.”
To do that the credit union needs tools and staff, said Caldera, whose company offers solutions to assist credit unions with not only understanding all the various compliance laws nationwide, but complying with them.
“You need to discover and classify and understand the scope of the credit union’s data—what is the scope of personal data all across your systems,” said Caldera. “You have to map that data and have visibility of data traceability end to end across the entire data lifecycle—this is the metadata aspect of it. You have to catalog it, know where it's coming from, where it’s moving to, where it’s consumed, and who is consuming it for what purpose…”
The Challenge
While credit unions, especially those with smaller assets, are challenged to afford additional staff, Caldera said this is one area they may need to spend HR resources on if all the privacy laws across the nation do not quickly become uniform with a federal standard.
Both credit union trade groups have advocated for a federal privacy standard.
“On top of the tools and your framework, you need people who understand metadata, data management and data analysis,” he said. “We advise credit unions to invest not only in the tools, but in the talent as well. And, right now, this can be a significant investment.”