Throughout 2021, the issue of data privacy became one of the central legislative questions facing lawmakers in Washington and state legislatures across the country. Data breaches at UC San Diego Health, Volkswagen and Audi, Facebook, and Robinhood raised public concern about how private companies and government agencies (mis)handle sensitive consumer information such as email addresses, social security numbers, and financial information.
2022 could very well shape up to be a significant year for data privacy in the United States as Congress will either be on track to pass a federal data standard that eliminates the zip code lottery and ensure Americans enjoy equal data protections or state legislatures will impose their own rules that further entrenches the patchwork of protections across the country.
Given the more limited oversight of state governments and ease at which bills become law, state-level data standards could fail to balance protecting consumer data and not imposing operational inefficiencies on small and medium-sized businesses.
Simply put, the best outcome for consumers and businesses is a federal data standard that protects consumer data and does not overburden small and medium-sized businesses.
Enhancing data protection for Americans is an issue that enjoys broad public support. A recent poll from the Associated Press and the NORC found that “more than 7 in 10 adults say the federal government should establish national standards for how companies collect, process, and share personal data to help protect the privacy and security of individuals in an increasingly online world.” These results mirrored a 2019 poll conducted by Pew Research and found that 79% of Americans were concerned about how private companies collect data.
Clearly, there is a real demand for greater data privacy rules in the United States.
With the significant public support for a federal data standard, both parties seem eager to act. For example, in September 2021, Sen. Richard Blumenthal (D-CT) called for the creation of a federal data standard, stating that “consumers have been forced to accept continuous data breaches and security lapses that compromise their intimate personal records.” Sen. Blumenthal also emphasized that “Americans’ identities have become the currency in an unregulated, hidden economy of data brokers that buy and sell sensitive information about their families, religious beliefs, healthcare needs, and every movement to shadowy interests, often without their awareness and consent.”
The passage of a federal data standard also enjoys bipartisan support. In July 2021, Sen. Marsha Blackburn (R-TN) argued, “the increase in cyberattacks and data leaks have made it extremely apparent to consumers that their online data may not be safe.” Republican support for a federal data standard is important to note because it dramatically increases the chances of passage.
While the passage of a federal data standard seems to enjoy bipartisan support, it does face potential headwinds. First, 2022 is a midterm year, so “members of Congress are probably devoting more time toward their reelection campaigns and supporting their own parties,” Secondly, “the federal government may not view it as much of a priority—with the Covid-19 pandemic still raging and other legislative issues dominating.”
If political headwinds do prevent the passage of a federal data standard, state governments look to step in and pass their own rules. Less than ten days into 2022, three states -Florida, Washington, Indiana- and the District of Columbia, have already seen data privacy bills introduced, with at least 15 states expected to consider bills this year.
While the passage of state-level data protections may seem like good news, American consumers and businesses will ultimately suffer. First, the state’s passing their own bills means that the patchwork of protections will become further entrenched, with consumers in some states enjoying more robust protections than others.
The patchwork of protections also makes it harder for companies, particularly smaller companies, to operate nationally. As the Washington Legal Foundation noted, the patchwork of protection creates “laws create operational inefficiencies and distort interstate markets for data, products, and services.” These inefficiencies ultimately drive up costs for consumers, forcing them to pay more for goods and services.
A federal data standard would eradicate the zipcode lottery and eradicate inefficiencies that are driving up consumer costs. While 2022 promises to be an important year for data privacy in the United States, much remains to be seen whether enhanced protections will emerge from the state or federal level. The best-case scenario for consumers and businesses alike is that the federal government passes a data standard that guarantees equal protection for every consumer and eliminates operational inefficiencies caused by the current patchwork state laws.