Data Privacy Happenings 📰
Hello from MineOS's monthly newsletter, The Privacy Mindset! 👋
The US is getting more serious about privacy, with Kentucky, Nebraska, and Maryland bringing the total states with data privacy laws up to 18. Are each of the 18 state laws similar, with the same requirements and exemptions?
Absolutely not!
Confused yet? You will be once these laws start entering into effect over the next two years, rendering a state-by-state privacy program utterly unmanageable.
The solution? A federal privacy law, and thus we come to the newly proposed American Privacy Rights Act. The APRA is in its infancy and will likely change considerably as it goes through committees in both the Senate and the House, but a federal law would cut through the complications of a patchwork of state laws.
One of the main problems facing the APRA? Preemption.
The law would take priority over state laws, which is a problem on both the left and right side of the American political aisle.
On the left, California--which helped kill the previous attempt at federal legislation, the ADPPA, does not want a weaker law overruling the rights and progress it has made for Californians, while on the right, many states are not comfortable throwing businesses into the fire with stricter data minimization protocols and giving individuals the right to private action (which means people could sue companies over alleged data privacy violations).
These negotiations and data privacy itself are urgent matters however, given the APRA would take action just 180 days after enactment. Yet even for an issue with bipartisan support despite criticisms, the path ahead for the bill is uneven and unlikely to result in a law passing in 2024.
The bill, beyond the preemption issue, is trying to cover a lot of ground on a lot of different topics, including AI algorithms, data breach reporting requirements, and of course, a host of privacy aspects such as an equivalent to California’s proposed Delete Act, establishing a universal method for issuing data subject requests through a national data broker registry.
Many of these desires are admirable, but impractical, and squishing them together into a single bill is a surefire way to slow down the legislative process during an election year that will prompt nearly all legislative business to cease come August.
America is trying and that's a positive, but brighter days are still a ways out for data privacy within the U.S.
