Lawmakers Should Tread Carefully When Trying to Balance Privacy with Security

It’s been said that a compromise is the art of dividing a cake in such a way that everyone believes he has the biggest piece. It remains to be seen if the recently introduced Information Transparency and Personal Data Act can elicit those feelings on data privacy regulations from both Republicans and Democrats in Congress.

Federal privacy legislation has been at a partisan impasse with Republicans seeking preemption of state online privacy regulations and Democrats looking to create a private right of action to sue. Rep. Suzanne DelBene’s (D-WA) legislation may be an olive branch to Republicans because it provides federal preemption and does not create a path for consumer class action lawsuits.

It’s unclear if the bill is enough to bridge the divide across the political aisle, but lawmakers should be cautious about the substance of any online data privacy legislation. If Europe’s and California’s forays into this area, balancing increased privacy with security—and the benefits of free flow of information with business interests—is trickier than it seems.

The Wall Street Journal recently reported on the growing frequency of successful appeals against rulings under the 2018 General Data Protection Regulation (GDPR) in the European Union. The harmful unintended consequences of the regulatory scheme to the EU tech market have been well documented. Stateside, the California Consumer Protection Act (CCPA) is so confusing that its enforcement was delayed for months and state lawmakers continue to tinker with the regulations.

As more states pass their own online privacy regulations, it’s become clear that federal preemption is necessary to protect the flow of online commerce in a national market. A patchwork of potentially 50 different regulatory regimes risks creating huge compliance burdens and making the most stringent state regime the national default regulatory environment. But federal lawmakers should proceed with caution when going beyond preemption in any legislation. There’s no reason to replicate the mistakes of California and Europe on a national level.