Did the GDPR just land on the west coast?

That is the question I was thinking about this morning. After reviewing California Bill AB375 which imposes European like restrictions on companies doing business in California that buy and sell large amounts of personal information.

As readers of this blog may recall, I have been unapologetically equivocated when it comes to expressing my opinion as to how much credit unions should really be concerned about the General Data Protection Regulation (GDPR). After all, there are several jurisdictional hurdles that European regulators would have to overcome before imposing penalties on a credit union which has no branches on the continent, does not actively seek out European citizens for membership and only incidentally has some members who qualify for the GDPR protection. That being said, your commitment to giving consumers control over their personal data is the direction in which things are headed.

The California law passed a few days ago shows that things are moving even quicker than anticipated. Most importantly, it gives consumers the right to request that a business that collects personal information disclose to the consumer “the categories and specific pieces of personal information” that the business has collected. This requirement only applies to a consumer who has worked with the business more than once and requests such information.

 

continue reading »