I recall that in the 1990s and early 2000s, it was often a struggle to get people outside of Europe to take EU data protection law seriously. The perceived lack of enforcement in the EU, and the dynamic legislative climate in the U.S., meant that more attention was given to U.S. developments.

The situation is now reversed, and there has been intense interest in the European Commission’s proposal for a General Data Protection Regulation published in January 2012, and in related developments such as calls for reform of the EU-U.S. Safe Harbor. U.S.-based lobbyists have descended in hordes on the EU institutions; U.S. government representatives travel to Brussels to lobby the EU, and U.S. authors publish articles and papers on complex issues of EU law. Brussels has become the center of the global privacy world.

This causes us in Europe to wonder: Why doesn’t the U.S. work as hard to improve its own privacy law as it does to lobby for changes in the EU?

There certainly is a lot to fix. Professor Daniel Solove has stated that “U.S. privacy law is so muddled that it can’t provide clear answers about how most types of data are protected.” One need only mention the differing state data breach notification laws to confirm the chaotic state of U.S. law.

The myth that the U.S. favors a “light touch” regulatory approach should also be laid to rest. U.S. law relevant to privacy frequently imposes enormous bureaucratic burdens (think of e-discovery requirements and Sarbanes-Oxley, to name just a couple of examples). And enforcement of the law by the U.S. Federal Trade Commission (FTC) is more draconian than anything in Europe.

Much U.S. law is also virtually unintelligible—not that EU law is any better! My recent attempt to read the FISA and its various amendments in detail caused me to react as Judge Richard Posner did when reviewing the Harvard Blue Book: “I have dipped into it, much as one might dip one’s toes in a pail of freezing water. I am put in mind of Mr. Kurtz’s dying words in Heart of Darkness—‘The horror! The horror!’—and am tempted to end there.”

Unfortunately, to an outside observer it seems that the U.S. has almost given up on privacy law reform, at least at the federal level. As The New York Times reported recently, the current gridlock in Washington has caused the U.S. states to increase their legislative activity—such as the new California “do not track” legislation—thus creating even more disharmony.

The only noteworthy current developments at the federal level seem to be the various initiatives undertaken by the FTC (e.g., the recent workshop on the “Internet of things”). But as useful as it is, FTC action cannot wholly replace the need for broader legislative reform.

I cannot help but wonder why European companies—for whom the U.S. is a huge market—do not lobby as hard to reform U.S. privacy law as U.S. companies do in Brussels. U.S. companies often complain about the cost of complying with 28 separate legal regimes in Europe, but isn’t complying with the law of 50 U.S. states just as burdensome?

Perhaps one reason for all the attention that EU data protection law receives is that it is proving to be the model many other regions (e.g., many countries in Africa and Latin America) look to when enacting their own legislation, so that effort spent in influencing EU developments has effect in other regions as well. By contrast, the U.S. model—to the extent that there is one—is so closely based on the special characteristics of the U.S. legal system that it is harder to export successfully.

The most significant legislative activity in the U.S. at the moment—at least to European eyes—seems to be proposals to reform data collection by the NSA and other intelligence services. In this respect, EU officials are clamoring for reform, so that after years of lobbying by the U.S. to change data protection law in Europe, NSA reform is one area where the shoe is on the other foot.

Developments in U.S. privacy law have led to similar measures being adopted in EU law (e.g., data breach notification requirements), and EU data protection law has had a major impact on how U.S. companies structure their activities. Thus, there has been a healthy cross-fertilization between privacy law in both regions; in order for this to continue, we need further legal reform, and on both sides of the Atlantic.