With the California Consumer Privacy Act in full force and effect, businesses in California and across the country are starting to wonder if the time to pass a national standard is now. However, with the 2020 election looming and little action from Washington, such a bill is unlikely to relieve California businesses in the near or even medium term future.
Today, California, Nevada and Maine have privacy laws, and several other states have bills working their way through their legislatures. California’s law is by far the most demanding of businesses, and it may get a shot of additional requirements and enforcement if Proposition 24 is passed by the voters. Nonetheless, groups like the Electronic Frontier Foundation find the CCPA and Prop 24 to be lacking, meaning that federal law could conceivably impose new requirements.
The benefit of federal law is the creation of a single standard for the whole country. Many businesses operate across state lines and will face compliance hurdles if required to track and comply with multiple different state laws. Federal law can address this by preempting state laws, effectively overriding individual state laws and imposing a single requirement.
Washington gridlock remains the largest impediment to passing a federal privacy standard. Congress has been effectively out of commission for years, failing to pass many laws when one party holds both legislative branches and even fewer when power is split.
Nonetheless, circumstances, news and the business community may require action in 2021. For example, the coronavirus has raised new issues around sensitive health data, as many businesses are gathering new data on their employees and customers as part of efforts to prevent the spread of the disease. In addition, there have been several high profile data breaches in the last few years, and another could serve as impetus for change.
Finally, the business community itself could push federal law over the edge. Several state legislatures are looking at passing new privacy laws and California voters are likely to approve additional privacy measures in November. Taken together these state-based rules may be the final push that leads to national reform.
In the meantime, though, relief for California businesses is not on its way. There are no serious discussions about a federal standard today in Congress, and any legislation would likely need to at least wait until after the 2020 election in November, and probably even then until after the 2021 inauguration and new Congressional class is seated. For now, the CCPA will be the law and businesses must be prepared to comply.