Greetings from Portsmouth, NH!

I write this last U.S. Privacy Digest letter of the year as we hold our annual Ping Pong Tournament here at IAPP headquarters. We have a competitive lot here (you should see what happens during our "Yankee swap" — it's cut throat, I tell you), so the cheering reverberates throughout 75 Rochester like an Olympic finals match.

No doubt 2018 was one crazy year for developments in privacy. And I'm not even talking about the GDPR. Of course, we all thought it was going to be all GDPR, all the time, but then California came along and completely changed the game. To quote Monty Python, "No one expects the Spanish Inquisition." Well, no one (or nearly no one) expected the California Consumer Privacy Act of 2018. 

The CCPA's effects rippled through privacy circles last summer, and continue to do so today by prompting very real talk about a potential federal privacy law. In parallel, the big tech companies are facing scrutiny for new data breaches, as well as their roles in spreading disinformation, fomenting hate speech, and preventing competition. CEOs from Facebook and Google, as well as other Silicon Valley giants, have faced tough questions on Capitol Hill. I'm sure we'll see more of that in 2019.  

Many of these topics came up during my interview this week with Sen. Maggie Hassan, D-N.H. She's one of 15 senators who have signed on to the Data Care Act, a bill that would place fiduciary-like obligations on online companies. She expressed concern about the business models of companies like Facebook, saying they're often in conflict with users' best interests and well-being. 

I asked her about the political realities of the Data Care Act, as it will likely face challenges from those on the left who don't think it goes far enough to protect user privacy and those on the right who would be concerned about giving the Federal Trade Commission additional regulatory authority. Notably, Sen. Hassan told me there are concerns about user privacy in both chambers of Congress, on both sides of the aisle, and because of the CCPA, she said, industry is willing to come to the table. At issue for privacy advocates and supporters of the CCPA, though, will be federal preemption. 

But perhaps we won't see any federal privacy legislation after all. There are a lot of uncertainties in our government right now. Plus, the CCPA still faces potential amendments before it goes into effect in 2020. 

Needless to say, 2019 looks to be a busy year for those tracking U.S. privacy law. Rest assured, we'll be here to keep track of it all. Until then, from all of us here at the IAPP, we wish you a safe and happy holiday season!

See you next year!