Rob Shavell (rob@getabine.com) is CEO and Cofounder of DeleteMe in Boston, Massachusetts, USA.
The privacy landscape for companies doing business in the US is rapidly changing. Alongside the California Privacy Rights Act[1] (CPRA), which stipulates tighter data protection for millions of California residents by 2023, state-level privacy legislation is becoming a defined trend. States such as Nevada,[2] Virginia,[3] and Maine[4] all recently passed comprehensive privacy laws. Other states, including Florida,[5] Oklahoma,[6] and Washington,[7] are due to follow suit over the next year. As legislation advances, compliance with privacy legislation now needs to become a major corporate concern for every business.
Big tech is also formulating its response to how the future of consumer privacy might look. Facebook and Apple, two of the largest companies trading today, have differing opinions[8] on how customers’ privacy should be treated. As a result of the increasingly divergent approaches to privacy in both the private sector and state-level legislation, a uniform privacy landscape now looks unlikely to happen any time soon.
Fragmentation is nothing new
In the near to medium-term future, the prospect of an array of different privacy legislation presents a new set of challenges for compliance that will remind some of previous efforts. Anyone familiar with the history of data breach legislation in particular will recognize a familiar situation starting to take place. Even though states have been irregularly passing data breach notification legislation since 2002, efforts to create a unified federal law have repeatedly come up short.[9] As a result, compliance requirements continue to vary from state to state.
However, while dealing with different compliance requirements around data breach notification is inconvenient for businesses, the potential challenges created by a new wave of privacy legislation may be on another scale. Various state-level privacy laws, each with specific reporting and regulatory requirements, are an inherently daunting prospect for businesses.