Legislation is well-positioned to move, if not get signed into law, before the end of 2020.
Consumer data privacy is a policy space that is complicated, has no recent history of congressional activity, and would require reforms that seemingly divide stakeholders and political parties. The complexity of legislating privacy, especially in finding the appropriate balance between industry and consumers, has effectively hamstrung policy movement in the past. A hyper-partisan climate and the looming 2020 election would add yet another layer to a growing list of reasons privacy legislation couldn’t move. However, the landscape is different this year and the legislation is well-positioned to move, if not get signed into law, before the end of 2020. Of course, there is a lot that needs to happen for privacy to advance, but there are four key reasons why this could be the year:
Urgency Around Passing a Federal Privacy Bill: The California Consumer Privacy Act (CCPA) took effect on January 1st and the corresponding regulations are expected to be enforced on July 1st. Like many consumer-focused state laws in California, the CCPA has created some urgency within Congress to act as policymakers fear additional states passing sweeping legislation like California or a patchwork of state laws develops that become difficult to comply with and manage. Furthermore, the European Union’s General Data Protection Regulation (GDPR) took effect in May of 2018 and has spurred similar concerns among industry. Given that these laws are now both in effect, Congress is under even more pressure to advance a federal privacy bill.
Bipartisan and Bicameral Support for Legislation: It hasn’t happened overnight, but Republicans and Democrats in the House and Senate are actively engaged in developing privacy legislation. Committee leaders have drafted bipartisan legislation on both sides of the Capitol. Policymakers are increasingly educated about the policy nuances and there is hope that those driving the debate share the same goals in terms of producing a bipartisan bill.
Industry is Actively Engaged Around Passing Legislation: Industry is often blamed for inaction on major federal policy issues. When it comes to privacy, industry is helping to move the debate forward (largely due to the urgency described above). While the technology industry is certainly leading the effort, most other industries that touch this debate are also advocating strongly for a new law with a federal pre-emption that would usurp state laws, including California’s. Having industry at the table is strongly welcomed by policymakers on both sides of the aisle.
Consumers Want Action on Privacy: As privacy concerns have been elevated in the media, consumers have increasingly called for legislative action. A Morning Consult poll released at the end of 2019 found the 79% of registered voters (including 82% of Republicans and 83% of Democrats) believe that Congress should prioritize privacy legislation in 2020. A Pew Research Center poll found that 70% of Americans want more regulation in the privacy space. Consumer engagement on this issue has helped move the debate and while it may not rival the economy or healthcare on the campaign trail, candidates are likely to hear from their constituents the privacy should be a focus in Congress.
While these policy drivers have positioned privacy well to advance this year, issues remain that will need to be resolved prior to legislation being finalized by either the House or the Senate, including whether the legislation will include a private right of action and whether it will include a federal pre-emption of state law. It will also be important to keep this legislative effort well outside focus of the presidential campaign; elevating this to a top-tier campaign issue for either side would dramatically increase risk to the legislative effort and could send those negotiating the policy provisions to opposite sides of the negotiating table.
That being said, there is real momentum around privacy that other major policies within this space have not shared in the past – largely because urgency, bipartisanship, industry engagement, and consumer opinion didn’t align as they have around data privacy. The next four to five months will be critical to the legislation’s path forward in both the House and Senate; until then negotiators will need to make sure the factors driving this don’t change.