2511 Practical Lessons 5509d4ae

# Practical Lessons from Multi-Statute Analysis

These lessons were learned from analyzing 19+ state privacy laws, comparing automated extraction against professional legal analyses, and conducting cross-jurisdictional compliance projects.

---

## Extraction vs. Analysis

### Lesson 1: Extraction Is Not Analysis

Extracting what a statute SAYS is different from understanding what it MEANS.

| Activity | What It Does |
|----------|--------------|
| **Extraction** | Captures text, requirements, definitions |
| **Analysis** | Interprets ambiguity, prioritizes, provides practical guidance |

**Implication:** Complete extraction is valuable as source material, but professional analysis adds:
- Interpretation of ambiguous terms
- Prioritization of which requirements matter most
- Practical compliance guidance
- Risk assessment

### Lesson 2: Flag Ambiguous Terms

Certain statutory terms inherently require judgment:
- "Reasonable" measures
- "Appropriate" safeguards
- "Material" changes
- "Unreasonable" risk
- "Significant" effects

**Action:** When extracting requirements, flag these terms. They mark where legal judgment adds the most value and where enforcement may be unpredictable.

---

## Structural Insights

### Lesson 3: Statutes Follow Predictable Patterns

Most statutes are organized similarly:
1. Purpose/findings
2. Definitions
3. Applicability/scope
4. Substantive requirements
5. Rights granted
6. Duties imposed
7. Exemptions
8. Enforcement
9. Penalties
10. Effective dates

**Benefit:** Recognizing this pattern allows rapid navigation of unfamiliar statutes.

### Lesson 4: Definitions Create Interconnected Webs

Statutory definitions are not independent:
- "Critical harm" may depend on "frontier model"
- "Frontier model" may depend on "compute cost"
- Tracing the chain is essential

**Action:** Map definition dependencies before analyzing substantive provisions.

### Lesson 5: Applicability Thresholds Determine Everything

Before extracting requirements, know WHO must comply:
- Revenue thresholds ($25M, $50M)
- Volume thresholds (35K, 100K, 175K consumers)
- Revenue-from-activity thresholds (25%, 50% from data sales)
- Entity type definitions

**Critical Distinction:**
- **Disjunctive (OR):** Meet ANY threshold = covered
- **Conjunctive (AND):** Must meet ALL thresholds = covered

A statute requiring "$25M revenue AND 100K consumers" covers far fewer entities than one requiring either.

---

## Requirement Types

### Lesson 6: Separate Disclosure from Operational Requirements

Statutes mix WHAT must be STATED with HOW parties must OPERATE:

| Type | Belongs In | Does NOT Belong In |
|------|------------|-------------------|
| **Disclosure** | Privacy policy, notice | Internal process documentation |
| **Operational** | Process design, training | Public-facing documents |
| **Technical** | System specifications | Policy language |
| **UI** | Design requirements | Policy text |

**Common Mistake:** Including "respond within 45 days" in a privacy policy requirements checklist. That's an operational deadline, not a disclosure requirement.

### Lesson 7: Time-Based Requirements Are High Priority

Time-specific obligations create hard deadlines:
- Response periods (45 days, 90 days)
- Reporting windows (72 hours)
- Retention periods (5 years)
- Review cycles (annual)
- Phase-in periods

**Action:** Extract time-based requirements separately and create a timeline view.

### Lesson 8: Consent Requirements Imply Disclosure Requirements

When a statute requires consent:
- There's an implied disclosure requirement (state that consent is obtained)
- But the consent mechanism is operational
- The policy says "we obtain consent"; the process actually obtains it

---

## Exemptions

### Lesson 9: Entity vs. Data Exemptions

Two fundamentally different exemption types:
- **Entity exemption:** The whole organization is exempt
- **Data exemption:** Only certain data is exempt; comply for other data

**Example:** HIPAA-covered data may be exempt, but the covered entity must still comply for non-HIPAA data.

### Lesson 10: Delayed Application Is Not Exemption

Some entities get delayed compliance dates, not permanent exemptions:
- Nonprofits may have 6-12 month grace periods
- The obligation eventually applies

**Action:** Track both permanent exemptions AND delayed effective dates.

### Lesson 11: Industry-Specific Exemptions Rarely Appear in Summaries

Beyond standard federal law carve-outs, statutes may exempt:
- Air carriers
- Electric utilities
- Riverboat casinos
- Licensed professionals

**Action:** Read the full exemptions section; don't rely on summaries.

---

## Cross-Jurisdictional Patterns

### Lesson 12: States Cluster Into Regulatory Philosophies

After reading several statutes, patterns emerge:

| Pattern | Characteristics | Example States |
|---------|-----------------|----------------|
| **Consumer-Protective** | Lower thresholds, fewer exemptions, stricter requirements | Maryland, California |
| **Business-Friendly** | Higher thresholds, broad exemptions, permanent cure periods | Indiana, Iowa, Kentucky |
| **Model-Following** | Based on existing templates with minor variations | Many post-2020 states |

**Benefit:** Recognizing which model a new statute follows accelerates analysis.

### Lesson 13: Rights Are Not Uniform

Do not assume all statutes grant the same rights:
- Some omit the right to correct
- Deletion scope varies ("all data" vs. "data provided by" the person)
- Sensitive data treatment differs (consent vs. opt-out)
- Not all provide profiling opt-out

**Action:** Verify which rights actually exist before listing them.

### Lesson 14: Definitions Vary More Than Expected

Key terms may differ across jurisdictions:
- "Sale" (monetary consideration only vs. "other valuable consideration")
- Sensitive data categories expand with each new statute
- Age cutoffs vary (13, 15, 16, 17, 18)
- Threshold formulations use different metrics

**Action:** Never assume a term means the same thing across jurisdictions.

### Lesson 15: The Most Protective Standard May Be the Safest Baseline

If complying across multiple jurisdictions:
- Identify the strictest requirements
- Use that as baseline
- Note where other jurisdictions are more permissive

---

## Enforcement Dynamics

### Lesson 16: Enforcement Mechanisms Shape Priorities

Two identical provisions may have different practical importance:

| Factor | Impact on Priority |
|--------|-------------------|
| AG-only enforcement | Moderate priority |
| Private right of action | High priority |
| Dedicated enforcement agency | High priority |
| High penalties ($10K+/violation) | High priority |
| Permanent cure period | Lower urgency |
| Expiring cure period | Higher urgency |

### Lesson 17: What the Statute Doesn't Say Matters

Important information includes:
- Rights or remedies explicitly EXCLUDED
- Common provisions notably ABSENT
- Issues left to regulatory discretion
- Safe harbors that DO exist

**Action:** Compare against checklists of typical provisions to identify gaps.

### Lesson 18: Political and Constitutional Context Affects Enforceability

A statute's requirements may never take effect if:
- Federal law preempts it
- Constitutional challenges succeed
- Political changes lead to repeal
- Enforcement resources aren't allocated

**Action:** For controversial statutes, assess preemption risks and pending litigation.

---

## The Analysis Process

### Lesson 19: Work Section by Section

Read an entire section before extracting individual requirements:
- Context from surrounding provisions clarifies ambiguous language
- Related requirements are often grouped
- Cross-references within sections modify meaning

### Lesson 20: Cross-Reference Rights with Duties

- Rights sections list what people can DO
- Duties sections specify what must be DONE or DISCLOSED
- Both inform complete compliance picture

### Lesson 21: Generate Practical Next Steps

After extracting requirements, translate to action:
- What must be done?
- By when?
- Who is responsible?
- What's the non-compliance risk?

---

## Common Pitfalls

### Pitfall 1: Mixing Requirement Types

A "policy requirements" checklist should not include:
- Response deadlines (operational)
- System capabilities (technical)
- Button placement (UI)

### Pitfall 2: Assuming Threshold Uniformity

Threshold language varies:
- Alternative vs. cumulative criteria
- Revenue percentage vs. dollar amount
- Consumer volume vs. transaction volume
- Different measurement periods

### Pitfall 3: Stopping at the Statute

Complete picture requires:
- Implementing regulations
- Agency guidance
- Court interpretations
- Enforcement history

### Pitfall 4: Ignoring Model Law Origins

Many statutes follow templates:
- Uniform laws
- Earlier state laws
- Federal frameworks
- Industry-drafted models

Identifying the model helps predict interpretation.

---

## Summary: Layered Analysis Approach

| Layer | Purpose | Method |
|-------|---------|--------|
| 1. Verification | Confirm current version, dates | Legal research |
| 2. Orientation | Understand structure, definitions | Reading |
| 3. Extraction | Capture requirements, exemptions | Systematic review |
| 4. Categorization | Group by type | Classification |
| 5. Contextualization | Compare to related laws | Research |
| 6. Interpretation | Resolve ambiguities | Legal analysis |
| 7. Prioritization | Identify key provisions | Judgment |
| 8. Action Planning | Convert to tasks | Project management |

Each layer builds on previous ones. Rushing to action planning without proper extraction leads to incomplete compliance.