Indiana, Iowa, and Tennessee Pass Comprehensive Privacy Laws
schneier.com
schneier.com
These laws are nearly worthless when they cannot be enforced by regular people. Laws such as these will be used as weapons by partisan attorneys general who will wield them to settle scores with companies that they don't like. When an organization that they do like violates a state privacy law, no action will be taken against them.
If they actually cared about data privacy, they would have written the law to be more like the TCPA, which can be enforced by anyone.
Is there some kind of monitoring database or notification that you can subscribe to?
It seems very expensive for every single business to have a compliance lawyer specifically for this task of complying with each state's mandates to a tee.
That said, there's no rule of nature that says running a business has to be cheap; it may not be optimal if all the laws in each marketplace are different, but I feel much less strongly about it — and not just because higher levels of government can unify and simplify when things get too much, nor just because I'm in Europe and one side of the border is all Rindfleischetikettierungsueberwachungsaufgabenuebertragungsgesetz and the other is Ustawa o przeniesieniu zadań z zakresu nadzoru nad etykietowaniem wołowiny because it's not just the law that isn't unified.
[0] of those laws that apply in general, at least; there's no need for normal people to know details of the accounting laws that apply to businesses unless the society really does want everyone to be a small business owner
It would have to be under the auspices of Interstate Commerce (to be legal under enumerated powers) but even then can Congress override State and local law?
Identifying standards/laws and then combing through them for applicable requirements is just part of early product design.
When there are an overwhelming number of jurisdictions, start with the local ones in depth. Do a survey on the rest to get a flavor for what other areas are doing. Shape the product so that compliance is most likely already done or easily actionable when you get around to deep diving the other jurisdiction's rules.
I get that software-only products often don't have to do this, but it's not like it's a dark art. And while having a lawyer in the loop is important, you're rarely asking them to read the standard/regulation to you. They help you understand and digest when needed, and make sure you're doing it right.
Now, the topic at hand here is privacy which is a bit different. Finding a design that respects privacy and is probably fine nationwide is much less complex than morphing the product by jurisdiction to match the local minimum viable compliance.
We laugh-complain about "ha ha the lawyers are designing our products now" but it kind of has to be the case in the complex legal environment businesses operate in.
It's not super hard to figure out why most startups don't have a lawyer.
I have almost literally no idea; running a business is totally outside my interests.
500 have a team that looks like 3x developer, a design person, and a sales person.
500 have a team that is like 1x developer and a Lawyer
Which one wins? Which hits market first? Which is more successful?
An early company has to spend money on the core product. If you get wacked by a lawsuit and shut down in year 2, it's a cost of doing business and you go do something else.
There isn't enough time in the day or money for an early startup to get every single law perfect.
So to answer the OP: You just do your best, and correct when you screw up.
They'll just also have massive supply-chain vulnerabilities :/
Unfortunately, being in business with a risk of going out of business is a better spot to be in than already being out of business.
If you mean the choice is between a team of 3x developers and 1x lawyer vs 3x developers a designer and a salesperson, the former will win. Design matters very little at the earliest stages, and there's nothing for the salesperson to sell so they are most likely going to make promises to potential customers the developer's can't meet. And if they get any traction, CA or the EU will crack down on them for any privacy violations, which will kill the startup. Meanwhile, the former will chug along until they have a viable product that satisfies regulatory constraints, and acquihire the latter.
The days of regulatory arbitrage as a viable business model are over. There will be no more Ubers and AirBnBs. Governments have caught up to that scam and are significantly more willing to crack down on that now.
hhahahahahha
Not all of us live in the bay ;)
Also my bay layer was $450 an hour, have never met a developer that cost me that.
> The days of regulatory arbitrage as a viable business model are over. There will be no more Ubers and AirBnBs. Governments have caught up to that scam and are significantly more willing to crack down on that now.
that is pretty good too. Keep up the comments, this is a riot.
The small guys duck under the radar.
It's kind of silly, but what happens when you have tons of laws. There is no realistic way a business of 1-10 people is going to be able to comply with every law in every state AND country they do business in.
It is. I've worked in healthcare, and it's not uncommon to have very specific requirements. However, there's no obligation to geolocate your customer beyond a simple request for their zip code, so it doesn't get too difficult from an engineering standpoint.
Control or process information of 25,000 or more Tennessee consumers per year and derive more than 50% of gross revenue from the sale of personal information; orAt least for this one, appears no need for a startup to have lawyers just for this, and if your start up gets to $20 million, you can afford the ~$400 to create another llc and split your income and not worry about it until you start making 49 million per year.
<- makes a saas that auto-creates a new llc every time company A gets 174k customers. <- not a lawyer, 5 minutes of DDG does not replace actual legal research.