Data Security: Policy Issue
Overview
When most people think about consumer data breaches, they often think of banks, credit reporting agencies and retailers. However, the rental housing industry is just as vulnerable. While doing business, rental housing owners and operators, and their third-party service providers, collect, use and maintain a significant amount of highly sensitive personal data about applicants, residents and employees. This information is used in a wide variety of essential business operations but also makes apartment operators a target of malicious actors. Given the ever-expanding cyber-threat landscape, defense against these vulnerabilities and ensuring data security remains a top priority for rental housing owners and operators.
Industry Position
The National Apartment Association (NAA), alongside our partner the National Multifamily Housing Council (NMHC), supports the enactment of legislation that creates a national cybersecurity, data privacy and breach notification standard that preempts state law and is reasonable, flexible and scalable. NAA and NMHC stand ready to work with Congress to create a federal data and privacy standard that recognizes the unique nature and needs of the rental housing industry while ensuring the data that our members collect, use and maintain is secure.
As an Owner or Operator, How Does this Affect My Business?
Apartment operators increasingly work across multiple states and must comply with a patchwork of different state laws governing data security and privacy. This regulatory framework drives costs, which ultimately affects housing affordability. As policymakers consider solutions to bolster consumer and data protection, NAA and NMHC believe that any federal legislation should provide for:
-
A clear federal preemption of the existing patchwork of often conflicting and contradictory state data security, privacy and breach notification laws.
-
A reasonable, flexible, and scalable national standard for data protection. Specifically, when establishing compliance obligations, this standard must consider the needs and available resources of small businesses as well as large firms and the sensitivity of the data in question.
-
A clear assignment of financial and legal liability to the entity that actually suffered the breach, particularly in the case of third-party breaches.
-
A requirement that third-party service providers must notify their customers of any breach and allow them to notify the consumer of the breach if they so choose.
Contact Information
To learn more about this issue, please contact NAA's Public Policy team.
For more Information: