In front of a packed room of privacy professionals during a breakout session here at the IAPP Global Privacy Summit 2019 in Washington, a discussion took place about movement.

Not about moving around the busy halls of the Marriott Marquis and the Walter E. Washington Convention Center, but rather about the movement within privacy legislation. Specifically, how ideals and provisions seen in other laws have traveled from the European Union to Washington state.

A panel of privacy professionals involved in the creation of those laws spoke about how they took from prior legislation to create bills and how a global perspective opened their eyes to the benefits of universal data rights.

Wirewheel CEO Justin Antonipillai moderated the panel that included Microsoft Corporate Vice President and Deputy General Counsel Julie Brill, Californians for Consumer Privacy Board Chair Alastair Mactaggart and European Commission Head of International Data Flows Bruno Gencarelli.

In his analysis of the California Consumer Privacy Act he helped spearhead, Mactaggart said the bill has more similarities than differences when placed next to the EU General Data Protection Regulation. What Mactaggart wanted for the CCPA was a focus on data access, transparency and security controls, all notable elements of the GDPR.

However, one of the biggest boosts for the CCPA was Mactaggart's opportunity to tout the GDPR's benefits to California residents.

"There are some areas where we didn’t cut and paste from the GDPR, but the conversation started in Europe," Mactaggart said. "It was way easier to tell the California legislature and the public that a population of 500 million people has this right, don’t you want it too? That resonated with Californians."

Mactaggart never assumed the CCPA would be the "be all, end all" bill, but rather as a big first step in the national conversation of privacy legislation in the U.S. Mactaggart likened it to the construction of a kitchen. Some will start with a sink, others will start with the stove, but the end goal is the same.

Mactaggart also finds it will be an untenable situation should some U.S. citizens have data rights while others do not. "I think that it’s going to be unsustainable to say, 'Hey, you Californians get all of these data rights,' and then you say, 'Hey, you in Nevada, you cannot.'"

The CCPA launched a movement in which states began to craft their own data privacy rules. Washington was one of those states.

Brill had backed the Washington Privacy Act, which despite her efforts, was not able to get to the floor of the state's House of Representatives for a vote. Brill said the CCPA had shifted the paradigm in privacy and became a watershed piece of legislation. While there had been sectoral laws, Brill noted, never before "had there been a baseline horizontal legislation until California came along."

Brill, a former commissioner of the U.S. Federal Trade Commission, said WaPa was crafted with elements from both the GDPR and the CCPA, including references to accountability and requirements to conduct risk assessments.

Unfortunately for Brill, WaPa did not make it all the way to becoming a law. That has not hampered her hope for it to resurface at some point down the line.

"I hate using the 'd-word,' but I would say it is very unlikely to pass this session," Brill said. "I do think the concepts around the privacy provisions are something lawmakers are still very interested in."

All the movement has not stopped at privacy legislation. Privacy professionals will have to grapple with what Mactaggart highlighted earlier with his example with Nevada. Some areas will have data rights, while others will not.

In order to address this issue in one regard, Brill said Microsoft decided to implement the data subject rights seen under the GDPR to its entire global base of customers. After the company made the decision, some of the results caught the eyes of staff.

"We see millions of people interacting with their data in some fashion, and the plurality of them are from the U.S. In the U.S. people care about this issue," Brill said. "We are going to need to think holistically about these approaches."

Privacy will continue to move its way down the road, but how fast can all of these developments go in a realistic manner? Antonipillai wrapped up the session by asking the panel whether a federal U.S. privacy law will appear before the end of 2020. 

According to the panelists, you might need to hit the breaks. 

Mactaggart said the people he has spoken to about a federal law are excited about the chatter that surrounds the topic, but he said they are not optimistic about a U.S. law appearing any time soon.

Brill reiterated those comments, adding she believes more states rules will appear in the interim. She compared it to the movement that took place after the first data breach notification law came into effect, which coincidentally also came from California.

"2020 will be an impossible year," Brill said. "If I had to predict, I think the conversations are just beginning."

Photo by Ryan Chiavetta