Attorney General Derek Schmidt of Kansas was recently elected president of the National Association of Attorneys General (NAAG) for the 2017–18 term. He is tasked with leading the most powerful association of attorneys general, which is composed of the 56 state and territorial attorneys general, and has selected for his Presidential Initiative a focus on protecting the elderly and other vulnerable populations. Schmidt has held his office since January 2011. Before his time as attorney general, Schmidt served in the state legislature and advised the governor. Under Schmidt’s leadership, Kansas has initiated several enforcement actions against companies for failing to adequately protect the personally identifiable information of their customers or employees and has weighed in on the effect of privacy policies on consumer rights. Here, he talks to The Privacy Advisor about his work on data privacy and security and how he will continue to target these issues as NAAG president.
The Privacy Advisor: Given your Presidential Initiative focusing on the elderly and other vulnerable populations, what guidance do you have for companies that market to these groups? What can we expect from your leadership in focusing on the privacy of vulnerable populations?
Schmidt: We live in an age where data is king. Nearly every time we make a transaction, personal data is collected. While we tend to associate this notion of “big data” with the large online companies, like Google and Facebook, it’s also being collected by neighborhood grocery stores and coffee shops when we use customer loyalty cards. This affects people in every generation. I think millennials may have a greater sense of the amount of data that is being collected on them than those in the older populations. So, it’s important for organizations to be upfront about what information they are collecting and how it is being properly stored, managed and used. As a group, attorneys general have put a lot of effort into the big issues of data privacy and security in recent years. I’m interested to learn from my colleagues this year on how these issues intersect with our focus on protecting elder Americans.
The Privacy Advisor: You are now at the helm of an influential group of attorneys general, who have a specific interest in privacy and cybersecurity issues. In fact, the recent NAAG conference in Montana included extensive discussions of data privacy and security in the context of new technologies, particularly the internet of things and connected cars. As you take on the role of NAAG president, what can we expect of future discussions and initiatives in this area?
Schmidt: As you said, it’s not just our smartphones and laptops that are collecting data on us these days. It’s now our cars, televisions, speakers — even kitchen appliances and thermostats. Our consumer protection and data privacy laws are always going to be chasing the technology. We have a lot to learn in this area, and the continued conversation among the states on how to best manage the legal issues that arise from technological innovation is always going to be an important mission for NAAG.
The Privacy Advisor: Several attorneys general at the recent NAAG conference emphasized the importance of attorneys general meeting with members of the private sector to share information on security threats and practices. What are the benefits of such collaboration, and do you intend to encourage such discussions as NAAG president?
Schmidt: A collaborative effort between the private sector and government is the only way this enormous challenge can be met. There has to be a balance between the legitimate business uses of data — many of which provide great benefits to the consumer — and the legitimate privacy concerns. Maintaining an open, honest dialogue is critical to understanding the potential threats and achieving the proper balance.
The Privacy Advisor: While you have served as Kansas attorney general, the state has become increasingly involved in policing consumer data privacy and security violations, including investigating companies that did not use secure methods in disposing of personal information. As part of those efforts, you proposed a bill, HB 2460, that was signed into law last year and requires businesses, government agencies and others that collect and hold personal information about customers or others to exercise “reasonable care” to prevent the information in their possession from being improperly disclosed to identity thieves or anybody else. What should companies be considering in complying with the “reasonable care” standard?
Schmidt: We’ve been discussing mostly digital information so far, but what really sparked the change in the law that we proposed last year was the improper disposal of paper records. Since I came into office, we’ve had several cases where a business has decided to dispose of old employee records, patient records and other documents containing highly sensitive information by just setting out boxes in or around a dumpster. It’s pretty clear that this method of disposal fails that “reasonable care” test. So, we worked closely with those in the industry and members of the legislature to craft something that I believe has struck that proper balance. The bottom line is to use common sense. When you’re storing personal information about customers, employees, patients, etcetera — whether it’s digital records or on paper — take reasonable steps to protect it. There are different standards in place in different industries, but some examples might be requiring secure passwords on computers that store this information or keeping personnel records in locked file cabinets. And, then, when those records are no longer needed, make sure that they are properly destroyed so they can’t fall into the wrong hands. Paper records should be properly shredded. Hard drives should be securely erased. We believe the “reasonable care” standard allows for some flexibility and adaptation that’s appropriate for the particular industry or business but maintains the general principle that information is to be protected while being stored and properly destroyed when no longer needed.
photo credit: The Open University (OU) Balance Scales (Ethics) via photopin(license)