What’s On the Horizon: 2021 State and Federal Data Privacy Legislation
January 26, 2021
By: Elizabeth L. Morgan, Fred J. M. Price, Shannon A. Knapp
The United States is continuing to see a flurry of state legislation concerning consumer data privacy. In 2020, at least 30 states and Puerto Rico considered some type of legislation related to consumer privacy. Most of these laws failed or were indefinitely tabled, likely due to the coronavirus. Most notably, the end of 2020 saw the passage of Proposition 24, also known as the California Privacy Rights Act (CPRA) (see our article available here for more information on CPRA).
The beginning of 2021 has followed 2020’s trajectory. Numerous state legislatures have already introduced comprehensive consumer privacy laws. These states include Connecticut, Minnesota, New York, Virginia and Washington. Washington state has been considering the Washington Privacy Act for two years, but it has failed each time in the Assembly. However, Washington has a good chance of passing a GDPR-like bill this year. The bill has overwhelming support in the Washington state Senate, and the primary stalling point in the state Assembly has been whether there should be a private right of action. Once this issue is resolved, the bill will have the support needed to pass. Unlike previous bills, this bill is divided into four parts. Part one concerns the processing of personal data by the private sector. In response to the COVID-19 pandemic, parts two and three concern the processing of personal data for public health emergencies. Part four includes miscellaneous provisions. If passed, the provisions would become effective July 31, 2022. Similarly, New York and Minnesota both reintroduced bills concerning comprehensive data privacy protections.
On the federal side, it is reported that President Biden has data privacy and cybersecurity on his executive agenda. With Democratic control of Congress, there is high potential for viable federal data privacy legislation in 2021 or in the years to come. The tech field anticipates that the Biden administration may focus on passage of a comprehensive federal data privacy law along with other acts related to data privacy and cybersecurity, such as reintroducing a cybersecurity coordinator to the White House and increasing Federal Trade Commission (FTC) enforcement activity. There is also bipartisan support for data privacy legislation as both Republican and Democrat representatives have proposed bills in prior Congressional terms that contain many similar provisions. The federal government is also working to address the invalidation of the EU-U.S. data privacy shield after the CJEU Schrems II decision.
2021 will likely see increased data privacy legislation enacted here in the U.S. and abroad. The COVID-19 pandemic increased business and non-business online activity pushing many legislatures to consider the need for increased data privacy regulations.
For more information regarding these new laws and how to prepare your business for compliance, contact Fred Price, Elizabeth Lehmann, Shannon A. Knapp or any one of our attorneys in the Cybersecurity and Data Privacy practice.
