Background
With states passing inconsistent laws and no uniform federal law addressing data privacy, there’s a patchwork of rules for companies to comply with. ALTA is dedicated to helping its members understand what they need to do to comply, if required, with data privacy laws.
ALTA Policy Position
ALTA believes any comprehensive data privacy legislation should include a full entity exemption for entities subject to the Gramm-Leach-Bliley Act (GLBA). Since 1999, this federal law has strictly limited financial institutions’ use and sharing of customers’ personal information. Additionally, financial institutions are required to assure the security of this information and provide comprehensive disclosures to consumers.
Data Privacy Principles
GLBA Protects Consumers' Privacy Rights
Resources
- ALTA-PRIA FAQs & Best Practices for Public Record Privacy Protections
- ALTA-PRIA Best Practices for Public Record Privacy Protections
- Basics of Privacy Rights
- Data Mapping
- Compliance Steps for US Privacy and Cyber Laws and Regs
- Suggested Privacy and Cyber Compliance Resources
- Data Privacy Implications for Service Provider & Third-Party Contracts
Webinars
Preparing for the California Consumer Privacy Act
- (Download PDF of presentation)
Compliance Webinar: Understanding Consumer Privacy Rights and Redaction Trends
- (Download PowerPoint Presentation)
Podcasts
ALTA Podcasts with Carlton Fields
State Data Privacy Laws
Click on any enacted state for links. Click "x" to close.
Data Privacy Articles
Recent 2026 2025 2024 2023 2022 2021
ALTA Joins Letter in Call for National Data Privacy Law
ALTA joined 37 other organizations in a letter requesting Congress take legislative action to develop a comprehensive national privacy law. The letter outlines several principles that should be included in the development of the privacy standard.
New Jersey Passes New Data Privacy Law
The legislation contains an exemption for personal data subject to the Gramm-Leach-Bliley Act (GLBA), along with an exemption for publicly available information. ALTA has held that any comprehensive data privacy legislation should include an exemption for entities subject to the GLBA.
California Updates Definition of Sensitive Information Under Consumer Privacy Act
A revision to the California Consumer Privacy Act (CCPA) definition of sensitive personal information that now includes a consumer's citizenship or immigration status went into effect Jan. 1, 2024.
California Court Delays Enforcement of Certain Privacy Rules
On June 30, the Sacramento County Superior Court issued a decision to delay enforcement of the California Privacy Rights Act (CPRA) regulations until March 29, 2024. Read on for the key takeaways from the ruling.
Oregon Joins Growing List of States to Pass Comprehensive Data Privacy Law
Oregon’s legislation, which goes into effect July 1, 2024, is modeled on the Virginia Consumer Data Protection Act (VCDPA) and contains an exemption to personal data subject to the Gramm-Leach-Bliley Act.
Delaware Passes Comprehensive Privacy Law
On June 30, the Delaware legislature passed the Personal Data Privacy Act. The bill, which awaits the governor’s signature, goes into effect Jan. 1, 2025.
Four States Pass Comprehensive Data Privacy Laws
Four states—Indiana, Iowa, Montana and Tennessee—recently passed comprehensive data privacy laws this year. All the bills contain a Gramm-Leach Bliley Act (GLBA) exemption, which ALTA has supported.
U.S. Lawmakers Reveal Draft Data Privacy Bill
Several members of Congress have published a discussion draft of a bipartisan federal privacy bill. In 2020, ALTA developed a set of data privacy principles that recommend the development of a single, national standard. Key aspects of principles include exemptions for entities already subject to the Gramm-Leach-Bliley Act, personal information that is already publicly available and business-to-business relationships. In addition, the standards say data privacy laws should recognize the need for businesses to share personal information needed complete a transaction. Consideration also should be given to the impact on small business, with respect to the cost of compliance relative to the risk of consumer harm, the principles say.