GDPR: Will the US Respond with Similar Federal Regulations?

GDPR, the General Data Protection Regulation, the EU data protection and privacy law has been in effect for more than one year. What is the likelihood that a similar law would be enacted in the United States?

Cindy Provin, SVP Entrust Datacard and General Manager nCipher Security, said that “what’s clear is that businesses are facing increased pressure to understand exactly how data is protected at every point during its lifecycle, in order to assess the vulnerabilities in their systems and processes. While it’s often challenging for businesses to take a holistic view of data protection, especially when multiple sources and technologies are involved, it’s necessary from a legal, financial, and frankly reputational, standpoint.”

The GDPR has influenced the thinking of many states in the US to implement regulations around data privacy protections. California signed into law the California Consumer Privacy Act, a GDPR-like privacy law. Alabama passed a law that imposes penalties on businesses that collect personal information without authorization. Other states like Vermont, Virginia, Oregon and Louisiana have put into law privacy laws.

Rob Perry, vice president at ASG Technologies, said that “the most impressive accomplishment of GDPR has been its role in kick-starting the data privacy awareness revolution. From the introduction of the California Consumer Privacy Act to the reconsideration of the Children’s Online Privacy Protection Act, the first year of the GDPR put the wheels in motion to create a globally safe, secure data landscape.”

Some are encouraging the federal government to take a bigger role. State-by-state regulations makes it very difficult for businesses to stay abreast of privacy requirements.

Julie Brill, Microsoft’s corporate VP and deputy general counsel, said that “laws currently on the books are simply not strong enough to enable the FTC to protect privacy effectively in today’s complex digital economy. Now it is time for Congress to take inspiration from the rest of the world and enact federal legislation that extends the privacy protections in GDPR to citizens in the United States

Doug Merritt, CEO of Splunk, said that “I think it’s imperative that human beings understand that there is economic opportunity in your data. But for government to tax corporations and try to give it back to people, I think that would actually darken the clouds and not open up the sky. What the government can do is set up regulatory frameworks and consequences for non-adherence. What I’d like to see within those frameworks is something in there about how I can broker my data. I think we all should expect that.”