Privacy

State privacy laws and the documents your business shares.

The United States has no single, general federal privacy law for businesses. Instead, a growing number of states have passed their own consumer privacy laws, and many more have data security and breach notification rules. For a business that works across state lines, the result is a patchwork.

Documents are where that patchwork becomes concrete. Payroll files, customer lists, tenant ledgers and loan files all carry personal information, and every time they are shared for a deal, an audit or a dispute, the question of how they travel comes up. This article gives an overview. For what applies to your business, speak with a privacy attorney.

Two kinds of state law

Comprehensive consumer privacy laws

California led with the California Consumer Privacy Act, later expanded by the California Privacy Rights Act and overseen by the California Privacy Protection Agency along with the state attorney general. Other states have followed with their own laws, including Virginia's Consumer Data Protection Act, the Colorado Privacy Act, Connecticut's Data Privacy Act, Utah's Consumer Privacy Act and the Texas Data Privacy and Security Act, among others.

These laws generally apply only to businesses that meet thresholds, which differ by state and are typically based on annual revenue, the number of residents whose personal data is processed, or the share of revenue earned from selling personal data. Many small businesses fall outside them. Some exempt data already covered by certain federal laws, or certain kinds of organizations.

Data security and breach laws

Separately, every state has a data breach notification law, and many have laws requiring reasonable security for personal information. Massachusetts, for example, has regulations requiring a written information security program for personal information about its residents, and New York's SHIELD Act requires reasonable safeguards. These security laws can reach businesses that are too small for the comprehensive privacy laws.

Themes that run through them

Details vary a great deal, but several ideas recur across state laws.

Notice: telling people what personal data you collect and why.
Rights: letting people access, correct or delete their data, and opt out of certain uses such as sale or targeted advertising.
Data minimization: collecting and keeping only what is reasonably necessary for the stated purpose.
Security: protecting personal data with safeguards appropriate to its sensitivity.
Contracts with service providers: setting out how vendors that process data on your behalf may use it.
Extra care for sensitive data, which can include Social Security numbers, financial account details, health information and precise location.

Several of these apply directly to document sharing. Minimization asks whether the recipient needs everything in the file. Security asks how the file is protected on its way and once it arrives. Service provider rules ask what the recipient may do with it.

Practical habits for sharing personal data

Before sharing, ask what the recipient actually needs. A buyer's first look at payroll may need roles and pay bands, not names and Social Security numbers.
Remove or redact what is not needed, and check that redaction removes the underlying text rather than drawing a box over it.
Share with named people, not with links that work for anyone who holds them.
Let people read without downloading where possible.
Set an end date on access and close it when the purpose is complete.
Keep a record of who received what and when.

The last point matters more than it seems. If a state attorney general, a customer or a court later asks where a file went, an accurate record is much better than a reconstruction from sent folders.

How ShareAndGo supports those habits

Every recipient confirms their own email address with a six-digit code before entering, so access is tied to a person. Groups decide which folders each audience can see, with download, print, copy and watermark controls for the room and for each group.

For view-only recipients, PDFs, Word, Excel and PowerPoint files are rendered on our side and watermarked with the viewer's name, email address and date, and the original is not sent to their browser. Invitations carry an end date if you set one and can be revoked at any time. Deleted files go to a recycle bin, and emptying it removes stored files and their previews.

The audit log records every view, upload, download, invitation and change, chained so that alterations are detectable, and exports as CSV. Search reads text inside documents, including scans, which can help when you need to find which files mention a particular person in response to a request.

If you need to describe where ShareAndGo keeps documents in your own privacy notices or vendor records: Your documents are stored in the United States. Some services run elsewhere, and our privacy policy lists them.

Common questions

Does my small business have to follow the California law?

Only if it meets the law's thresholds and other conditions. Many small businesses do not. A privacy attorney can confirm where you stand.

Do state laws cover employee data?

Some do and some exclude it, and the position has changed over time in some states. Ask counsel about the states where your employees work.

Is there one federal privacy law I can follow instead?

Not for businesses in general. Federal laws cover specific sectors and data types, and state laws fill much of the rest.