Greetings from Portsmouth, New Hampshire!

The week after P.S.R. has been one of downloading, debriefing and contemplation. Between side events, sessions, conversations, late nights (thank you, Boston Red Sox) and early mornings, events like P.S.R. come and go in the blink of an eye. Now's the time for perusing notes, connecting with new contacts, and reflecting on an ocean of new information. 

For some of us here at the IAPP, however, P.S.R. was just the beginning. Several IAPPers repacked their bags last weekend — as I'm sure some of you did, as well — and traveled overseas to Brussels for this year's star-studded ICDPPC conference. The theme? Ethics. Together with the United Nations, the IAPP released a white paper on building ethics into privacy frameworks. 

But ethics wasn't the only headline from Brussels. Apple, Facebook, Google and Microsoft all came out in support of a U.S. federal privacy law this week. Of course, some of this wasn't news. Apple and Google testified to the U.S. Senate commerce committee that they supported a law, and Microsoft has been active this year promoting GDPR-like privacy controls for users around the world and has called for a national law since 2005. This week, Facebook Chief Privacy Officer Erin Egan joined the growing chorus, saying the company would support a GDPR-like privacy law in the U.S. 

In his dispatch from the ICDPPC, Sam Pfeifle wrote, "Thus, representatives of four of the top seven technology companies in the world stood on the floor of the European Parliament, in front of the world's privacy regulators, and endorsed a new U.S. federal privacy bill in public. Are they resisting and undermining the effort in private? That would now require some gumption, indeed." 

The sentiment from these four companies was reflected Monday in a newly proposed framework from the Information Technology Industry Council, which includes Apple, Facebook, Google and Microsoft, as well as many other hardware and software giants as members. According to the ITI, the framework was inspired by the Fair Information Practice Principles, the GDPR and the Asia-Pacific Economic Cooperation's Principles and Cross-Border Privacy Rules. No doubt it has some progressive takes on constructing a privacy framework. It aims to align with existing global privacy regimes, avoid "onerous process requirements that degrade the user experience," encourage innovation (of course), and enable research on machine learning and artificial intelligence that relies on the use of personal and non-personal data. 

Notably, the framework also defines personal and sensitive personal data, taking a cue from the GDPR: "'Sensitive personal data' is personal data consisting of ethnic origin, political affiliation, religious or philosophical belief, trade union membership, genetic data, biometric data, health data, sexual orientation, certain data of known minors, and precise geolocation data." Unsurprisingly, the framework also promotes transparency, security, accountability and risk management, but it also backs individual control rights "where reasonable to the context surrounding the use of personal data." 

It wasn't just industry talking federal privacy law this week, though. The American Civil Liberties Union collected together a consensus list of what all stakeholders agree should go into a bill, at minimum. Accordingly, stakeholders agree that a federal bill should require transparency for customers, some form of data portability, notice and consent to share personal data, breach notification, and the adoption of reasonable security measures. 

Where stakeholders will do battle, however, is in the preemption of state law, the level of enforcement powers for a regulator like the Federal Trade Commission, and limits on the use and retention of data. Is it time to move past the old notice-and-consent regime? The ACLU thinks so. 

As machine learning, artificial intelligence and other advanced technologies process more and more personal data, how can an average consumer understand, and thus knowingly consent to, how his or her data will be used? No wonder this week's ICDPPC event focused on ethics.