Data Security and Privacy Regulation in the U.S.A: A 50-State Legislative Survey

Abstract

The last several years have seen an astronomical acceleration in data collection, storage, and transfer, driven by the rise of connected and smart technologies. However, this increase in automated and connected infrastructure has brought with it a host of unprecedented risks in the cyber world, exposing personal data and information systems to cybercrime worldwide. Although efforts have been made to address these issues, federal data security measures for critical infrastructure sectors have been slow to emerge. Recognizing this gap and the massive amounts of data being collected from individuals every day, some states have begun enacting generally applicable data privacy protocols. However, state regulations governing data security are jurisdictionally limited, unsynchronized, and inconsistent in scope. This paper aims to provide an overview of current data security regulations across all 50 state jurisdictions, with a focus on key points of interest in the transportation industry, for both industry stakeholders and policymakers. While not exhaustive with respect to consumer data privacy laws, this survey addresses some of the most pressing compliance issues for data managers in both public and private settings.