Womble Bond Dickinson survey reveals corporate preparedness for requirements taking effect in 2023, along with progress on steps to manage risks in using geolocation and biometric data

With new consumer privacy laws set to take effect in several states in 2023, nearly six in 10 executives say their organizations are very prepared to meet these requirements. Yet when asked about particular actions taken, less than half have completed key steps toward compliance.

That discrepancy is one of the key findings in Womble Bond Dickinson’s 2022 State of US Data Privacy Law Compliance Survey Report, which draws on the insights of nearly 200 executives – 62% of whom hold C-suite titles – from company leadership and critical departments. In addition to providing a window into where companies stand in their data privacy compliance journeys, the report delves into two increasingly popular forms of consumer data collection: precise geolocation data and biometric information.

State Data Privacy Laws Preparedness and Challenges

Five states – California, Colorado, Virginia, Utah and Connecticut – have now passed data privacy laws or amendments that will take effect in 2023, while several other states are weighing similar comprehensive legislation. Though 59% of executives say their companies are very prepared to meet the guidelines set forth by new privacy legislation – and 89% have increased their budgets to do so – less than half have completed most key compliance actions, including conducting data mapping (49%), performing data assessments (43%), and establishing metrics and deadlines to track compliance (38%).

“Companies often feel they are ready for compliance, but that optimism starts to fade when it comes to applying the often unsettled regulations and granular tactics they need to effectively prepare,” said Tara Cho, chair of Womble Bond Dickinson’s Privacy and Cybersecurity team. “The new requirements affect so many aspects of how companies do business that it can be challenging, particularly at the executive level, to make sure all the bases are covered.”

A large part of the problem is operational, which is exacerbated by the pandemic consuming a disproportionate amount of legal and IT resources. Respondents who do not feel their organizations are very prepared cite lack of available staff to address compliance (39%) and challenges around tracking the status of legislation and differences between state laws (60%).

The survey data also reveals potential issues in how companies assign primary responsibility for privacy compliance. Less than a third of those that have designated a project manager for data privacy compliance, or are in the process of doing so, have assigned the role to a member of the risk or compliance (18%) or legal (11%) departments. Most project leads reside in technology (56%) or information systems (14%).

“Preparing for these new laws – understanding the necessary policies, procedures, compliance and governance practices – is really a risk management and legal issue,” said Ted Claypoole, a partner at Womble Bond Dickinson with extensive experience in privacy and security issues. “Ideally, organizations would have a cross-functional task force that includes tech and compliance professionals, with a primary lead to ensure things get done.”

The Growing Risks Posed by Geolocation and Biometric Data Collection 

The growing ubiquity of smartphones and wearables offers significant opportunities for businesses but also potential challenges. Over 70% of executives say they are very (42%) or moderately (29%) concerned about state privacy laws that include specific restrictions on collecting and using precise consumer geolocation data for mobile tracking purposes. The primary concerns expressed by respondents center on securing consent from consumers to gather and apply this data (68%) and on defining the specific business purpose for such data applications (64%).

As for biometric data, while 59% of survey respondents are already using it and another 19% plan to do so, fewer than 60% of those respondents have assessed their risks (58%) or developed risk management strategies and compliance plans (55%). Even fewer have conducted internal training sessions (41%) or drafted notice templates (36%). With an uptick of complaints alleging violations of the Illinois Biometric Information Privacy Act on the rise and other states considering similar legislation, now is the time for companies that collect biometric data to conduct risk assessments and take steps to avoid potential enforcement actions and litigation.

Additional Key Findings 

• Retail and tech sectors are more concerned about data privacy compliance. Executives from these industries – who together comprised 47% of all respondents – expressed significantly more concern than their counterparts about several issues covered in the survey. For example, of those who fear enforcement actions related to geolocation data, 75% of retail executives say it is due to their industry being a likely target (compared to 57% of respondents overall). In addition, 33% of retail and tech executives say their organizations have increased their budgets for complying with new state privacy laws by 20% or more (compared to 24% of all respondents).

• Nearly nine in 10 respondents support a federal data privacy law. Eighty-eight percent of executives would like to see a federal law that preempts individual state legislation and creates a consistent set of requirements – echoing the sentiments of corporate and technology trade groups concerned about a growing patchwork of state privacy laws. 

• Influence of consumer privacy-related requirements from tech companies. While respondents indicated that their privacy policies are more heavily influenced by state privacy legislation than requirements from tech companies, the latter holds more sway for companies in the tech and especially retail industries. One respondent said of the influence of tech companies: “We depend on those relationships, and we need to stay in compliance with their guidelines.”

The survey was completed by 182 decision-makers who play an active role in data privacy issues across a range of departments within their organizations, including general management (17%), information systems and information technology (31%), privacy and security (19%), legal and compliance (18%), marketing (8%) and operations and finance (7%). To read the complete report and methodology, please click here.