In the first six months of 2021, there were 1,767 data breaches reported across the globe, exposing over 18 billion records. To contextualize that number, more records were exposed in six months than people on earth. Data breaches not only compromise consumers’ and businesses’ financial situations, but they can also lead to unnecessary stress and anxiety.
Despite the ramifications and number of data breaches, the United States does not have a comprehensive data protection law. The federal data laws that exist cover banking, medical records, and children. In the absence of federal legislation, several states have enacted their own pieces of legislation that have created a zip code lottery of protections for consumers.
To ensure consumers enjoy equal data protections, Congress needs to step up and pass a comprehensive data protection law. Without it, Americans will continue to face uneven protections that leave sensitive data vulnerable to cybercriminals.
A comprehensive federal data law would be welcome news for American consumers who regularly express concern about data privacy. In April, an opinion poll conducted by Morning Consult foundthat 83% of Americans believe that Congress should make privacy a priority in 2021. Moreover, this support was not partisan, with 86% of Democrats and 83% of Republicans believing data privacy should be a priority for Congress.
For companies seeking to operate across state lines, the absence of a federal data law creates unnecessary compliance costs that burden businesses. A 2019 study by the Washington Legal Foundation found that state-level data protection laws “create operational inefficiencies and distort interstate markets for data, products, and services.” The Washington Legal Foundation also found that the inconsistent and continually evolving state data privacy laws “drive up costs, imposing a drag on economic actors who shift resources to compliance” instead of hiring, innovating, or developing new products.
The issue is particularly pronounced among smaller businesses and startups that do not have the capital or legal resources available to larger companies.
A federal data privacy law would allow businesses to focus their efforts on enhancing consumer welfare instead of worrying about compliance with inconsistent and continually evolving laws. A federal law would also allow businesses to operate with confidence across the country, safe in knowing that they are unlikely to face litigation from consumers or attorneys general for non-compliance.
A federal law would resolve the zip code lottery created by inconsistent and weak state-level protections for Americans. For example, while Virginia, California, and Colorado have passed comprehensive data protection laws, the other 47 states offer varying degrees of protection. These discrepancies create a situation whereby those living in Bluefield, Virginia, enjoy more protections than those in Bluefield, West Virginia — even though they live in the same town that spans both states.
While Virginia has substantial data protections, West Virginia has few protections that leave its citizens vulnerable to data breaches. For example, West Virginia’s Consumer Credit and Protection Act only requires companies that have suffered a data breach to notify consumers if sensitive data such as social security numbers, driver’s license numbers, or bank account information has been compromised. In addition, companies are only required to report breaches to consumer reporting agencies and the state if the breach affects more than 1,000 West Virginians.
A federal data law would go a long way in alleviating these discrepancies by preempting state laws that fail to provide adequate coverage for Americans. A federal data law would also increase consumer confidence, making them more willing to purchase goods and services from companies dependent on consumer data.
For Congress, passing a comprehensive federal data law should be a no-brainer. Consumers want action, as do businesses that operate in multiple states and suffer from unnecessary compliance costs. The passage of a federal data law would not only provide businesses the confidence they need to innovate and grow, but it would also eliminate the most egregious consequence of federal inaction, a zip code lottery that fails to provide equal protection to Americans. It’s time for Congress to pass a federal data law. Failing to do so will not only harm consumers and businesses but will cast further doubt on an institution that only one in three Americans approve.
This was published in Real Clear Policy.