2023 has seen a flurry of enforcement activity at the federal level with the FTC focused on sensitive health information. This sets the tone for the entry of state regulators enforcing new requirements for processing “sensitive” personal data state privacy laws coming into effect in 2023 and beyond. This panel will examine how sensitive personal data is treated under new state privacy laws, the operational impacts, and what to expect from enforcement, including:
- The different contours of what counts as “sensitive” under different state laws, including categories of information covered and the application of key parts of definitions, such as whether information “reveals” a sensitive category about a consumer or supports an “inference” about a sensitive category.
- Considerations for operationalizing requirements for information categorized as “sensitive,” such as obtaining consent from consumers and conducting DPIAs.
- The tools state regulators have for enforcing requirements for processing sensitive personal data, including the private right of action under Washington’s My Health My Data Act.