Data privacy laws and the regulatory activity associated therewith, continue to evolve across most jurisdictions in which we operate. Given the complexity of these laws, uncertainty regarding their interpretation, application, and enforcement and the often-onerous requirements they place on businesses regarding the collection, storage, handling, use, disclosure, transfer, and security of personal data, it is important for us to understand their impact and respond accordingly. Failure to comply with data privacy laws can result in substantial fines or penalties, legal liability and / or reputational damage and litigation.
In the U.S., state-level momentum continues to increase as more U.S. states continue to enact, or are considering more stringent privacy laws, which may impose varying standards and requirements on our data collection, use and processing activities. Continued state by state introduction of privacy laws can be expected to lead to significantly greater complexity in our compliance requirements globally, which could result in complaints from data subjects and/or action from regulators and potential litigation claims. If we do not provide sufficient resources to ensure we are able to respond, adapt and implement the necessary requirements to respond, or we do not respond sufficiently to the various forthcoming changes, which could include federal data privacy requirements in the U.S., while continuing to maintain our compliance with global data privacy laws, this could adversely impact our reputation and we could face exposure to fines levied by regulators and class action and similar litigation risks, which could have a significant financial impact on our business.
Outside of the U.S., countries continue to adopt data privacy laws, with many placing stringent requirements on companies when handling and sharing personal data. There also continues to be a growing trend of countries outside of the U.S., where privacy laws are in place, amending those existing data privacy laws, to further enhance and extend an individual’s rights over their personal data and the obligations placed on companies that handle this data. For instance, Canada has proposed a new data privacy law, Bill C-36, which, if passed, would introduce new obligations regarding the collection, processing and disclosure of personal data on private companies. For each affected jurisdiction, we will need to assess and understand each new piece of legislation, in order to plan for and implement required changes.
As a consequence of the evolving landscape, regulatory guidance and action also continues to increase, particularly across the EU and U.S., with a growing number of enforcement activities and monetary penalties being issued by the regulator. The continuously evolving and developing landscape can be interpreted and applied differently from jurisdiction to jurisdiction and may create inconsistent or conflicting requirements.
One area of increasing risk is the rapid use of artificial intelligence and the evolving legal and regulatory landscape governing its use. The cross-jurisdictional nature of artificial intelligence introduces additional compliance complexity, particularly where emerging artificial intelligence-specific regulation overlaps with existing data privacy requirements when
21
processing and transforming personal data. The pace of regulatory change requires continual monitoring and adaptation of governance, risk management, and compliance frameworks.