I gave a presentation at the Tribal Net conference this week on the importance of tribal data protection laws and regulations. Sounds like a snoozer, but think about this, yesterday there was a news article about a data breach at a tribal casino. As tribal enterprises, we frequently gather information on our gaming patrons, hotel guests, employees, tribal members, etc. But I have yet to find a tribe that has thought about this as a sovereignty issue and has taken steps to draft and enact data privacy and/or consumer protection laws.
As we bring people to our reservations or gaming websites and we gather their personally identifiable information, we have a responsibility to protect that information. Of course tribes have sovereign immunity and cannot be sued without a waiver, but in my opinion, it is a poor business decision to rely on sovereign immunity as a defense for the release of an individual’s private information. AND as we have seen in the payday lending context, the FTC is willing and has in fact exerted jurisdiction over tribes in that context. The fines imposed by the FTC can be significant and there is no sovereign immunity defense for FTC investigations and decisions.
Instead, a tribe should exercise its sovereignty by:
- Enacting data privacy laws or regulations.
- Enact consumer protection laws.
- Ensure these new laws have enforcement provisions and provide recourse to injured individuals.
- Create a contract review process so you know what data privacy and consumer protection laws you may have agreed to be bound by.
- Create a compliance process.
- Ensure you have cyber security insurance coverage.
Tribes are now a part of the global economy and governments (U.S. and internationally) are committed to protecting their citizens and their private information. Tribes should be aware of this and begin to take proactive steps to protect their resources from potential liability.
One of the best things about being a Indian lawyer and advising tribes is that tribes can literally take destiny in our own hands and develop laws from the ground up that work for us, our people, our patrons, our employees all while protecting sovereignty!