State data privacy laws vary: Do you know your rights?

Almost everything we do is facilitated, enabled, or tracked by websites or apps, from working and exercising to shopping and socializing, and even navigating city streets and sleeping.

But companies — many of which provide these convenient services free of charge — don’t just provide us with information and ease. They take something, too: personal data.  

How your personal data is used   

Personal data can be defined as any information that relates to an identifiable person.

In the case of digital personal data, it’s information about yourself that you or your device share with a website or app. That can include your name, email address, bank account information, and Social Security number, as well as IP address, browser cookies, and device ID numbers.

Sometimes, it can include social or cultural information — such as your religion, ethnicity, or location.

When you download an app, sign up for a newsletter, post something to social media, enter a question into a search engine, and otherwise interact online, you’re sharing pieces of personal data with whatever company you’re engaging with.

Businesses can collect, analyze, and use this personal data to learn more about you, which they can then use to improve your customer experience and tailor marketing messages to you. They may also share your personal information with other companies and/or data brokers, which are firms that specialize in collecting consumers’ personal data.

Is that so bad?

The more your data is shared, the greater your risk of falling victim to identity theft and fraud. Suppose a company that’s storing your personal information suffers a data breach. That leaves your information vulnerable and susceptible to theft.

If a company that does not have your information suffers a breach, there’s no need to worry or take action.

How your personal data is protected

With the rapid growth of the data economy over the last few decades, more attention has been put on data privacy.

To date, there’s no comprehensive federal data privacy law in the United States. There are some federal laws in certain industries that address personal data and its collection or use. Among them are:  

• HIPAA (the Health Insurance Portability and Accountability Act) 

• FERPA (the Family Educational Rights and Privacy Act) 

• COPPA (the Children’s Online Privacy Protection Act) 

Over the last few years, many states have enacted their own privacy laws to protect the personal data of their residents.

Data privacy laws by state

Data privacy laws vary from state to state. Some state privacy laws empower you to do more with your data, while others have fewer restrictions on companies — or none at all.

In general, you'll find at least one of these three consumer-friendly rights in states with comprehensive privacy laws like California, Colorado, Connecticut, and Virginia — as well as states that are in the process of enacting such laws such as Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, and Utah.   

• Request to access: This is your right to know what personal data a particular company has collected about you, what’s being done with it, and with whom, if applicable, it is sold to — giving you greater transparency. If a company is collecting personal information about you that you would prefer for them not to collect (such as your birthday or credit card information), you can be aware of it and even remove it in some cases. 

• Request to correct: This is your right to request to correct inaccurate personal information a company may have about you on file. This ensures that any information stored about you is accurate and up-to-date — and that identity thieves cannot exploit any errors if they get their hands on your data.

• Request to delete: This is your right to ask a business to delete your personal data collected by them. Keep in mind, deleting some or all of your information from a company's database may also erase your account or account activity history. You may, however, be able to remove select information that you deem unnecessary, so the company only collects the information necessary to provide its services.

For a detailed look at each state's data privacy laws — and a breakdown of consumer data privacy legislations that may be passed in the coming months — visit the International Association of Privacy Professionals (IAPP) US State Privacy Legislation Tracker or check your state's attorney general or legislation website.

More ways to protect your personal data

While state privacy laws are a positive move toward privacy protection, it’s still important to take additional steps to safeguard your personal information.

As you engage online, keep your digital footprint in mind. Know that when you accept a website’s cookies, you are authorizing that company to track your personal data. Also, depending on where you live, companies may share your data with other businesses or data firms without your knowledge.

The more you know about — and control — where your data lives, the better protected you are.