This is the third and last in a series about the road to a general-purpose U.S. data protection law and the pitfalls on that road. The focus here is on areas of agreement between business and consumers. There are, in fact, some areas where the interests of both camps overlap.

Before moving there, we should acknowledge a major division in the business community. Some American multinational companies see the need to move toward international (i.e., EU) data protection standards. These companies see one set of privacy rules that work everywhere as the least costly solution. Microsoft is an example. Others in the business community still wish that privacy would just go away. They would prefer a meaningless privacy law that gives consumers few rights, imposes few obligations on business, and totally preempts state laws. While a bit simplistic, for purpose of this discussion we can divide the business world into the privacy-willing and the privacy-unwilling camps.

The area of agreement between consumers and the privacy-willing business community should be clear. Both groups want to work toward a law that meets EU standards for adequacy. Consumer advocates recognize that broadly applicable requirements that implement EU data protection solutions will leave consumers better off than they are today. Privacy-willing businesses want a law recognized by the EU as adequate so that personal data can easily flow across international borders to the U.S.

There are, of course, a few barriers to reaching consensus. Let me count the ways.

First, consumer advocates will want as much as they can get, while the privacy-willing businesses will want as little as they can get away with. There’s still a lot of room in the middle here, even if we ignore the privacy-unwilling companies for a minute.

Second, it’s not enough for all sides here to reach agreement on a privacy bill. In the end, it will be up to the EU to decide whether a law is “adequate” or not. The 2015 Schrems decision by the Court of Justice of the EU narrowed the grounds for evaluating adequacy, holding that adequacy means equivalency. The court also tossed out the weak-kneed, look-the-other-way Safe Harbor agreement that papered over differences between the U.S. and the EU for about 15 years.

The court’s decision, fueled in part by the Snowden disclosures, started a process that led to a much more substantive set of standards for U.S. companies, the EU-U.S. Privacy Shield. Even that remains controversial in Europe, and its ultimate prospects await another decision by the CJEU. Even if it survives, the Privacy Shield is cumbersome for willing participants. Other solutions to the data export problem like binding corporate rules and contracts are complex and expensive. A finding of adequacy would be much simpler for business.

Third, after all these years, some in the U.S. still think that they can “fool” Europe with a meaningless privacy law. There is no chance of that. The EU data protection establishment knows privacy backwards and forwards, and it will have no trouble evaluating any U.S. law. In my opinion, there is no case for the adequacy of any existing U.S. privacy law, except perhaps the Fair Credit Reporting Act. We must move a long way to obtain an EU blessing, and we really won’t know until after the law passes.

Fourth, one important EU standard is the requirement for an independent privacy agency. That will be hard. I addressed some of the difficulties in earlier parts of this series. No one should think that just giving more responsibility to the FTC will work. The agency would need an enormous boost in staff, authority, budget, and fortitude. The agency would need jurisdiction over areas of the economy that have not been subject to the FTC at all (insurance, transportation, federal, state, and local governments, and more).

Personally, I’ve advocated for an independent privacy agency for more than thirty years. As a House staffer in the mid-1980s, I drafted the first modern privacy agency bill. Creating a new agency, however, would be just as challenging as enhancing the FTC or any other existing agency.

Fifth, no one should assume that the consumer advocacy community is monolithic. It is true that consumer groups mostly work together harmoniously today, much more than in the past. But when it comes to finding compromises, there are likely to be major disagreements. For example, one highly controversial part of the GDPR is the right to be forgotten. Civil liberties groups with strong concerns about the First Amendment will have different views on RTBF than some privacy groups. If internal differences are intense within the consumer (and business) community, progress will be slow or nonexistent.

Sixth, strong presidential and congressional leadership can be crucial in overcoming differences and enforcing discipline on negotiators. I don’t think I need say much here about the absence of these qualities today.

Seventh, I observe that the U.S. and the EU often take a fundamentally different approach to making rules. The GDPR, like the Data Protection Directive before it, sets out broad policies. For example, the GDPR has a provision on data subject access rights that contains a few hundred words (336 actually), plus some nuance in a recital or two. A U.S. law could never be that simple. Every industry would lobby for its own flavor of limitation or exemption from access. The statute (or regulations) just on access would go on for page after page.

Finally, Europeans complained about intense lobbying by Americans as the GDPR moved through the process. If Congress seriously considered a privacy bill, every lobbyist in the U.S. would be active, and the EU lobbying on GDPR would look like child’s play compared to what will happen here. Intense lobbying may be the final barrier to progress on privacy.

In the end, what are the real prospects for a broad U.S. privacy law?

It is apparent that there are many obstacles: substantive, procedural, and political. If everyone worked in good faith, it’s conceivable that something acceptable could emerge in a few years. However, I don’t think that there is enough consensus in the U.S. privacy world to have much hope right now. Maybe the dynamic will change as the EU moves to enforce the GDPR. Maybe not.

photo credit: Bold Frontiers Washington DC Capitol - HDR via photopin (license)