A blanket data privacy law seems unlikely for Americans anytime soon, and that’s why states have continued to step into the breach. Cybersecurity expert Scott Allendevaux argues that we’ll continue to see these laws proliferate until Big Tech takes the hint.
What Information about you lives in the deep recesses of Big Tech’s massive data collection files? Most people have no idea, and what’s even worse is many of them don’t even have the right to know. That’s because, despite an urgent need for protection, basic data privacy safeguards are lacking in many states and the nation as a whole.
As the amount of data collected expands on a daily basis, a vast majority of Americans are left vulnerable — unnecessarily in the dark — unable to requisition what has been collected by Big Tech.
Unless those collecting data react to the wave of legislation sweeping across the nation by affording greater transparency to users, they will find new regulations foisted upon them, and not necessarily ones they find appealing.
Users deserve to know what’s being collected. App developers would be wise not to hide it in some obscure, dark corner of the site. Convenient access is a necessity.
Copy & paste
It is easy to learn what will eventually come down the pike. Frameworks for such laws are readily available. States are largely using a copy-and-paste process, taking best practices from jurisdictions that have already enacted comprehensive legislation, laws that are working with varying degrees of success. No doubt, Americans will have the same access to data disclosures as those residing in the more than 130 nations with data privacy laws, eventually. Privacy rights in the European Union are especially robust, thanks to GDPR. That’s why we’ve seen a proliferation of high-profile judicial actions against the largest names in the tech industry when those restrictions are violated.
As more privacy laws are enacted, even on a piecemeal basis, there will come a time when constituents will ask why they are not afforded the same rights and protections as, say, someone in Oregon or Iowa, where privacy and security protection legislation will go into effect this year and next, respectively.
Big Tech bears the responsibility of transparency. Because they are intransigent, and unwilling to act voluntarily, state legislatures will compel them to come clean.
Will 2024 Finally Be the Year for Federal Data Privacy Law in US?
With a notoriously ineffective legislative body at the federal level, hope may seem thin, but cybersecurity expert Scott Allendevaux makes the case that 2024 may be perfect time.
Read moreDetailsNational solution? Don’t hold your breath
Hoping for a uniform national solution to data protection? You might be waiting in vain. Given the track record of Congress, which took years to address the exploitation of minors by Big Tech, it could be a decade before they tackle the issue of data protection.
Technology moves ahead at a breakneck speed; it is unfortunate that legislative initiatives move at a speed that can only be described as glacial.
It’s understandable that certain state legislatures may hesitate to impose stringent regulations on businesses. Many legislators feel the government has already exceeded its authority by enacting laws that restrict business operations. Additionally, a well-financed army of lobbyists is constantly influencing legislators, warning them of potential negative consequences if they interfere in areas they perceive as outside their purview.
But that’s a wrongheaded view. States have a responsibility to protect their residents, assuring that they can control and direct how their own data is used. Failure to act is only an act of indifference to the voters who put legislators in office. We’re talking about basic consumer rights for a modern-day world.
Privacy rights legislation is widely embraced, without the controversies associated with subjects like healthcare, economic development or education. Composing comprehensive legislation is a light lift. There’s no need to be a trailblazer. Templates exist. They can be molded and adjusted as necessary to fit the needs and wants of a particular jurisdiction.
With the impending implementation of privacy laws in multiple states, the pressure mounts for lagging jurisdictions to catch up. Big Tech will be held accountable for its opaque practices, and state legislatures must step up to ensure transparency and accountability.
The time for delay is over. Every person deserves the fundamental right to control their personal data. It’s a matter of basic consumer rights in the digital age. Legislative frameworks exist, and it’s incumbent upon states to adapt and implement them swiftly. With the expertise and guidance available, there’s no excuse for inaction. The protection of privacy is not a luxury but a necessity, and states must act decisively to safeguard the interests of their constituents in the face of technological advancement.
Scott Allendevaux, LP, CISSP, CIPP/US, HCISPP, CIPT, CIPM is senior practice lead at Allendevaux & Co., an Ohio-based cybersecurity agency. 
