In the face of these challenges, we recommend using the upcoming California Privacy Rights Act (CPRA) as a benchmark in 2023. The CPRA, the follow-up to the California Consumer Privacy Act (CCPA), goes into effect on January 1, 2023, and emphasizes respecting opt-out preference signals, including Global Privacy Control (GPC). The law builds on the CCPA with new provisions, including the requirement that businesses give special notice to people if they intend to use or collect personal information. In addition, companies must wait at least 12 months before asking individuals who opted out of sharing for their consent.
Another Option For Compliance
General Data Protection Regulation, or GDPR, is another way to ensure compliance, and one that we recommend healthcare marketers consider carefully. The European law – arguably the most rigorous privacy and security law worldwide – expanded existing data privacy protection in 2018, providing a rigorous framework for maintaining and processing data. And, while many companies believe they are exempt because they don’t market abroad, this is not true: doing business with any “EU data subjects” requires compliance with regulations and requirements.
A wide variety of data is protected under GDPR, and includes:
Basic identity information
Health and generic data
Racial or ethnic data
Sexual orientation information
Additional data categorized as “basic identity data”
This data is protected by eight rights for individuals, listed here. To begin implementing GDPR, businesses must assign a processor who maintains personal data records, as well as a controller to determine how and why data is processed.
If you are unsure about your current compliance, or would like to take a closer look at your specific data collection processes, we can help. Contact us to learn more about collecting, enriching, and managing first-party data.