WASHINGTON—NAFCU has joined with several other organizations to provide insights on Uniform Law Commission's Uniform Personal Data Protection Act (UPDPA).
The finalized UPDPA was presented by its drafting committee during a meeting last month.
The final UPDPA provides a path to vicarious liability where an entity, either primary or third-party, has actual knowledge of a related entity’s prohibited data practice and could have prevented or disclosed such practice. In those circumstances, the entity may be held vicariously liable for inaction, NAFCU said.
Of note, the organizations said the UPDPA would provide credit unions with an information-level Gramm-Leach-Bliley Act (GLBA) exemption – similar to what is provided by the California Consumer Privacy Act (CCPA). However, in Virginia, legislation providing credit unions with an entity-level GLBA exemption has recently been passed.
In the letter, the organizations noted it is "crucial that any uniform state privacy bill promotes harmonization." However, the group explained that the UPDPA discourages uniformity through its enforcement provisions by enabling the use of "all remedies" under state consumer protections status – which would potentially open the door to allow aggrieved parties a private right of action (PRA).
‘Disparate Enforcement’
"Enactment of the UPDPA, in its present form, would result in disparate enforcement between states having and lacking PRAs," wrote the group. "Consequently, identical law will be interpreted differently in each state through litigation. Exclusive Attorney General enforcement will bring greater uniformity across states, as AGs can collaborate with each other in developing effective privacy regulatory regimes to protect consumers."
The UPDPA will be formally presented July 11 at the ULC’s 2021 Annual Meeting in Madison, Wis.