Throughout 2022, analysts have been closely monitoring the almost 200 data privacy bills being considered by state legislatures. Despite the significant number of bills being considered by states, only two- Connecticut and Utah– were able to enact bills into law this year. While the passage of data privacy bills in Connecticut and Utah have provided millions more Americans with necessary protections, millions more still live in states that have abdicated their duty to their citizens.
Congress must step in when states fail to meet their most basic job of protecting their citizens.
Currently, the United States is a zipcode lottery of data protection, with inconsistent rules creating a patchwork of consumer protections. Americans living in California, Utah, Colorado, Virginia, and Connecticut enjoy robust protections, while those living in other states enjoy few and often limited protections.
Thankfully, Congress has the opportunity to eradicate this patchwork of protections and provide Americans with equal data protection and data privacy rights by passing the bipartisan American Data Privacy and Protection Act (ADPPA) that is currently being considered by the House of Representatives and Senate. While the bill is not perfect, it is an important first step in ensuring consumers enjoy the data protections they deserve and would finally bring the United States into line with China, the European Union, the United Kingdom, and Canada.
In short, ADPPA “would establish basic consumer data rights; impose certain obligations on how all organizations process personal data and create additional requirements for large data holders and third-party service providers that process data.”
Private right of action and the absence of preemption are flaws in the bill that Congress must correct if it wants to pass a data privacy bill that balances the rights of consumers and businesses while also eradicating the zipcode lottery that has plagued American consumers. Thankfully, as the bill progresses through the legislative processes, lawmakers have the opportunity to correct these weaknesses.
A federal data standard would be welcome news to the millions of Americans who worry about how private companies handle their sensitive information. In 2019, for example, 81% of U.S. adults worried they had little or no control over the data private companies collect. Additionally, 81% said the potential risks of companies collecting data outweighed the benefits. Furthermore, Morning Consult found that 83% of voters believed Congress should make data privacy laws a priority. Such stark concern over how companies handle data outlines the necessity of passing a federal data standard.
For companies seeking to operate across state lines, the absence of a uniform federal data legislation creates unnecessary compliance costs that burden businesses, particularly small businesses. A 2019 study by the Washington Legal Foundation found that state-level data protection laws “create operational inefficiencies and distort interstate markets for data, products, and services.” The Washington Legal Foundation also found that the inconsistent and continually evolving state data privacy laws “drive up costs, imposing a drag on economic actors who shift resources to compliance” instead of hiring, innovating, or developing new products and services.
The issue is particularly pronounced among smaller businesses and startups that do not have the capital or legal resources available to larger companies.
With a clear understanding of data protection responsibilities, small businesses will not only have the confidence to operate in multiple states, but they will be better placed to scale their operations, employ more staff, and innovate new goods and services for consumers. Like any bill being considered by Congress, ADPPA is far from perfect. Some legitimate concerns exist around the private right of action and preemption of state laws provisions that could leave the patchwork of protections in place. Notwithstanding these genuine concerns, Congress must not let good be the enemy of perfect because allowing the status quo to continue could be more harmful to American consumers.
Published in the Economic Standard