What the New Privacy Legislation Means for Healthcare Marketers

That39s evidenced by the 12 million fine imposed on Sephora in 2022 the first of its kind under the California Consumer Privacy Act CCPA which went into effect in June 2020 The court decision clarified a broad definition of quotsale of dataquot to mean any exchange of data not explicitly one of monetary valueCalifornia followed the European Union in creating the CCPA The EU introduced the General Data Protection Regulation GDPR in 2018 Now three other statebased regulations have emerged The California Privacy Rights Act CPRA which amends and adds to the CCPA went into effect January 1 2023 as did the Virginia Consumer Data Protection Act VCDPA Three other states have comprehensive privacy legislation going into effect later this year Colorado and Connecticut on July 1 and Utah on December 31In addition a patchwork quilt of states have either introduced bills or have bills currently stalled in their legislatures that all share the same end goal to protect user privacyThis poses big challenges for marketers Those that use data to target and reach the consumer with personalized messages need to navigate new legislation as it unfolds so they remain compliantYashina Burns has some ideas on the best ways to do that She39s Vice President of Legal and Privacy at DeepIntent an advertising platform specifically focused on the healthcare advertising vertical Burns explains that to some degree all the new legislation is modeled on the GDPR however there are differences quotGDPR is built on a foundation of consent in order to use people39s dataquot she says quotbut the state laws focus on an optout modelquotHowever the differences do not end there Colorado and Virginia apply a consent model to data that is considered sensitive such as biometric or health information However if that data is necessary for the business to provide the service that the consumer signed up for the optout is not guaranteed The laws provide for a balance of business and consumer interestBurns points out another distinction The GDPR applies to anyone in the EU including noncitizens In contrast the US laws are based on state residency quotFrom a businessimpact standpoint that makes it more difficult for businesses to complyquot Burns notes quotEspecially in the digital space there39s no way to tell that someone is a resident of Colorado California or VirginiaquotIn order for marketers to make sure they aren39t breaking the rules quotyou have to have internal documentation for all the state lawsquot she adds quotAnd in a state like Virginia you have to submit an assessment that you39ve performed internally upon requestquotPharmaceutical marketers have additional and unique concerns They have been beholden to Health Insurance Portability and Accountability Act HIPAA federal regulations since 1996 Because of that the state privacy laws have a carve out for HIPAA deidentifed information and HIPAA protected informationHowever while HIPAA regulates the collection of personal health information in regard to diagnostics and prescriptions it does not account for a user visiting a site and purchasing a medication In that case data collected can come under the umbrella of the state laws as it now involves a sale There is also the risk of reidentification of the user While it is a small risk it is possible if data sets are crossed improperly Statistical standards and measurements are needed to prevent that something that DeepIntent already has in placeBurns says that the basic principle of all the privacy laws is transparency quotThe AdTech industry understands they need to provide transparency to consumers to make sure we39re acting in accordance with people39s expectationsquot she saysWhile these laws affect all marketers Burns39 advice to pharma marketers in particular is to make sure you know what data sits in your systems and that it is accurately categorized Also map out the flow of data so you know who you are receiving data from and that they are also compliantThis should be reflected in contracts with the vendors Be sure to ask them the right questions For example find out if the vendor has proper transparency how they process user requests and how they vet their vendors It39s also important to make sure your website is updated with proper disclosures and user39s rightsThe Internet Advertising Bureau IAB along with the IAB Tech Lab are trying to help companies comply with these new privacy laws with the creation of the MultiState Privacy Agreement It includes a technology toolkit to help publishers and advertisers work with vendors and manage these new regulations However this only works with everyone in the industry complies with the termsDeepIntent has signed on After all it only makes sense quotto follow industry standards and support anything that creates some level of uniformityquot Burns concludesClick the social buttons to share this story with colleagues and friendsThe opinions expressed here are the author39s views and do not necessarily represent the views of MediaVillagecomMyersBizNet

SUBSCRIBE FOR FREE MEDIAVILLAGE CONTENT | BECOME A THOUGHT LEADERSHIP CONTRIBUTOR

What the New Privacy Legislation Means for Healthcare Marketers

Author

Publish date

Channel

Joanne Tombrakos

FEMA and the Ad Council Encourage AANHPI Communities to Enhance Disaster Preparedness in New PSAs - Ad Council InSites

More Videos:

SUBSCRIBE FOR FREE MEDIAVILLAGE CONTENT | BECOME A THOUGHT LEADERSHIP CONTRIBUTOR

What the New Privacy Legislation Means for Healthcare Marketers

Enjoying This Commentary? There's More to Love

Joanne Tombrakos

TAGS:

FEMA and the Ad Council Encourage AANHPI Communities to Enhance Disaster Preparedness in New PSAs - Ad Council InSites

Cookies