With no framework yet for a federal privacy law, states that took the initiative to regulate online firms' use of personal data may end up providing models for Congress.
Following the passage of the landmark California Consumer Privacy Act last year, bills were introduced in at least 25 states addressing different aspects of data privacy,
While policymakers in other states looked to California’s bill as an example, its delayed implementation may have caused some wariness since the effects weren't yet apparent. Instead, states like North Dakota approved studies to examine consumer personal data disclosures.
Lawmakers who brought California's proposal to their home states "ran into questions about how has this law played out in California, and there weren’t answers on that,” Tsukayama said. “It’s good that people are talking about this in their legislatures, but apart from specific pieces of privacy legislation, we haven’t seen another big sweeping privacy bill.”
The delayed implementation of California's bill also created an opening for amendments that might soften it. Google and trade associations representing Silicon Valley titans (such as the Internet Association, TechNet, and Consumer Technology Association) have all lobbied for modifications,. The state legislature considered a slew of changes, some of which won approval in at least one chamber, in its most recent session.
“We certainly did see the tech industry
come in with a number of bills, with provisions that made the privacy industry very uneasy, to carve out things, to change definitions in the bill, things that extended far beyond the simple fixes that may have been overlooked because it passed so quickly,” Tsukayama said.
Internet companies argue the alterations to the law would improve its clarity and fairness.
Jim Halpert, a partner at law firm DLA Piper and co-chair of its global data protection practice, commended the ideas in California’s bill, but said it was confusingly drafted.
It’s not totally a great model to use in other states,” he said. The timing for a federal framework may now be right.
“We’re at an inflection point where on the one hand, privacy issues are perceived as being really important, but also the business community now realizes that state-by-state regulations are not sustainable and it is time to make a deal on federal legislation,” he said.
Part 1