After passage of the California Consumer Privacy Act (CCPA) in 2018, the industry began to worry about the potential headache resulting from a patchwork of divergent state privacy laws. Given the size of California’s economy and the large presence of tech companies in the state, without federal legislation preemption, the CCPA would effectively become the law of the land. All eyes have now turned to Washington to see how Congress will react.
As the 116th Congress began, a bipartisan working group in the Senate set out to develop legislation to address consumer data privacy at the federal level. Six months later, that working group has yet to publicly release any draft legislation or even guiding principles. Similarly, in the House, the committee of jurisdiction has quietly been working on federal privacy legislation, but has not shared any updates with the public or industry stakeholders. Ultimately, comprehensive legislation, particularly on a topic as complicated and nuanced as data privacy, is difficult to enact. Add in the historically complicated political dynamics surrounding preemption and the task becomes even more difficult.
At this halfway point in the year, Democrats in both the House and Senate seem open to supporting a federal data privacy law that preempts California and other states, but only in exchange for high privacy standards that may be difficult for their Republican colleagues or industry to accept. As always, the devil is in the details.
Speaker Nancy Pelosi, who has been relatively quiet during the legislative negotiations, adds an additional complicating layer of politics to the debate. She not only controls the House agenda, but she is also the senior-most representative from California. Her constituents might prefer that she protect the legislation from her home state rather than acquiesce to its preemption. Observers will be looking to her like the Roman Emperor in the Coliseum. A thumbs down from the Speaker means a privacy law with preemption is all but dead. So far, she has been willing to let the committees work to resolve the issue.
Ultimately, unless industry advocates are quickly able to convince Democrats that preemption is necessary and better for consumers while also convincing Republicans to support a compromise on privacy standards, then the CCPA will become the law of the land on January 1, 2020.
