How Data Privacy Laws are Changing

November 9, 2019

Do you create profiles of your clients to target them in your marketing efforts? If so, you’re collecting their personal data—and you may one day be held liable for that information.

Starting Jan. 1, that will be the reality for real estate professionals in California. That’s when the California Consumer Privacy Act will go into effect, with enforcement beginning in June 2020. But even if you don’t reside in the state, this legislation is something all practitioners need to pay attention to because it may apply to them in the future. Many other state legislatures are looking at similar measures, including Pennsylvania, Massachusetts, and New York.

Jean-Paul Cart, attorney and partner with law firm Schiff Hardin LLP, gave an overview of the forthcoming law Friday at the Technology and Privacy in Real Estate Forum during the REALTORS® Conference & Expo in San Francisco. The CCPA gives consumers the right to know what personal information a company intends to or has already collected from them—including those marketing profiles you’ve created, Cart said. The law also gives consumers the right to know what information companies have shared with others. Personal information includes anything that can identify a person or household, such as names, email addresses, IP addresses, social security numbers, driver’s license numbers, passport numbers, professional education information, commercial information, and geolocation data.

The law will apply to for-profit entities that collect personal information from consumers who are California residents. To exempt small businesses, the company or organization subject to the new law must also have one of the following: More than $25 million in gross annual revenues; annual collection of data from at least 50,000 consumers, households, or devices; or half of their annual revenue coming from the sale of consumer information.

If you’ve been storing data in inefficient ways, Cart said, such as paper files that include personal information in unsecured places in your office or electronic data on various platforms, the law will require you and your agents to organize and secure that information. “The bottom line is you’re going to need a process to comply with these requests,” he said “You’re going to have to keep track of where all the data goes. And you’re going to have to be able to tell consumers who has access to their data, such as a mass-market mailing company.”

Companies that are subject to the new law must provide a means for customers to opt out of data collection, demand deletion of their data, and the right to equal service—meaning, even if they opt out, they can and will receive the same service from your real estate firm. “You cannot make it hard to opt out,” Cart said. “You need a phone number they can call, and if you’re dealing with paper, you’re going to have to give them a form they can sign.” Plus, businesses need to have a process in place for handling requests within a designated period of time.

Cart expects other states to follow similar principles and guidelines as the CCPA in their legislation, so it would be worth it for broker-owners to begin putting data collection systems in place now.