Technologies / Data Privacy and Security

Given public concern over consumer data privacy, data breaches and online marketing/advertising, Congress has proposed a new comprehensive data privacy regime that includes a private right of action for data privacy and security violations.

Supports a single federal standard for data privacy and security laws consistent with the following principles:

• Collection of personal information should be transparent. REALTORS® respect consumer data privacy expectations, and develop, implement and communicate data privacy/security policies to clients.
• Use, collection and retention of personally identifiable information. REALTORS® collect and use data only to provide consumer services, and maintain appropriate policies for the reasonable retention and proper destruction of any personally identifiable information.
• Data Security. REALTORS® maintain reasonable security standards and procedures regarding access to client information.
• Disclosure of personally identifiable information. REALTORS® do not reveal personally identifiable data to third parties unless information helps complete a consumer initiated transaction; the consumer requests it; the disclosure is required or allowed by law; or the consumer has been informed about the possibility of disclosure and provided with an opportunity to opt-out.
• Maintaining consumer privacy in business relationships. If a REALTOR® provides personally identifiable information on behalf of a consumer, the third party should adhere to privacy principles like REALTORS®.

Opponents of legislation/regulation are generally concerned about limiting business practices which could curtail business models or create excessive costs for business. Others believe that the proposed legislation's private right of action could fuel meritless lawsuits as currently drafted thus creating an unnecessary cost burden on main street businesses.

Congress has been considering legislative proposals which:

• Cover entities handling sensitive information with few exceptions;
• Set data security standards for banks and non-banks;
• Contain a private right of action enforcement mechanism; and
• Provide for a "floor" federal preemption of certain state and common laws.

Congressional authorizing committees have not voted proposed legislation out of committee at this time.