Countries and economic unions around the world are adopting national privacy laws. Rather than state-by-state privacy legislation, wouldn’t it be easier to have one all-encompassing privacy law for the U.S.?
Imagining a National Business Landscape Without a National Privacy Law
If the current trend continues and more legislative bodies recognize the critical importance of consumer data protection, it is just a matter of time before all 50 states adopt their own privacy regulations. However, with no national privacy law in place, each state would have its own unique framework with different requirements and nuances on how the personal and sensitive data collected from individuals within their state may be collected, handled and shared, as well as what reporting and notification process must be followed in the event of a breach. This would likely require any organization doing business with customers nationally to understand and be ready to comply with 50 different sets of privacy regulations — a time-consuming, costly and complicated undertaking.
Furthermore, without a national law to unify regulations, the variations in state-by-state compliance laws will likely lead to inconsistent requirements for establishing legal consent and permitted use of an individual’s data, further complicating for example the handling of children’s data and guardian consent. It also means there will be multiple ways permitted to sell and purchase personal data, in addition to various penalty frameworks for violations.
Having multiple state data compliance laws will create complex barriers that make it difficult for businesses to appropriately respect the privacy rights of individuals. This will also lead to higher overhead costs relating to privacy and data security, including increased risk mitigation costs for insurance and risk regulatory penalty provisions, legal overhead cost as well as more third-party tools and staff to ensure compliance with different state privacy requirements.
The Case for a National Privacy Law in the United States
A national privacy law would create a unified standard for data privacy across the board, eliminating any discrepancies and streamlining the compliance process for organizations. A national law would also enable the federal government to set the tone at home and abroad that the U.S. is more serious than ever before about protecting the data privacy of all citizens, not just those who happen to be protected through individual state laws.
In addition, a correctly implemented U.S. national privacy law that is trusted by the European Union would enable organizations to comply with the General Data Protection Regulation (GDPR), the current gold standard for consumer data protection and privacy covering individuals in Europe. This would enable U.S. businesses to more freely process and transfer EU customer data, provided they are in compliance with the equivalent U.S. national privacy law that has been deemed adequate by the EU. As more countries around the world, such as South Africa and Brazil, adopt their own national privacy laws, the lack of a privacy law in the U.S. has created a vacuum, preventing U.S. businesses from effectively competing on the world stage.
The need for a national privacy law is clear, but it will not be an easy feat. The United States Congress must first acknowledge the urgency for a national privacy law and collectively decide to implement one. As general awareness around the importance of consumer data protection continues to proliferate, Congress must act decisively to enact a national privacy law not only to help U.S. businesses compete globally, but to protect American citizens in a consistent and fair manner.
Stephen Cavey is Co-Founder and Chief Evangelist at 
