Efforts to create state privacy legislation are being undertaken in rapid succession across the U.S. of late. Most agree the desire each state has to address privacy is a positive development, but there’s also agreement that the state-by-state "patchwork" of laws is problematic for compliance.
Advocates for a federal privacy bill that would preempt state laws would tell you that's the ideal alternative to the patchwork problem. But it could be months — or even years, some predict — before that comes to fruition. Knowing that, the Uniform Law Commission is prepared to try its hand at crafting a law that works for all.
The ULC has formed a drafting committee for the Collection and Use of Personally Identifiable Data Act, which was presented at the committee’s first drafting meeting Feb. 21 and 22 in Washington. The committee’s goal is to draw up legislation by 2021 for states to adopt, potentially creating a more unified approach to privacy law across the country.
The ULC, comprising qualified law practitioners from across the U.S., describes its legislative process as one that "provides states with non-partisan, well-conceived and well-drafted legislation that brings clarity and stability to critical areas of state statutory law."
"The (ULC) has been around for 100 years or so and was formed largely for these kinds of activities," CUPIDA Committee Chairman Harvey Perlman said. "States or constituents desire uniformity while Congress is either unavailable or decides it’s not an appropriate issue to become involved with. So in this case, we’re going to take a shot at it and see what we can do."
In general, the ULC’s work has been viewed favorably by state lawmakers over the years, CUPIDA Committee Reporter Bill McGeveran said, who pointed to the Uniform Commercial Code as an exemplary piece of ULC-created legislation adopted in all 50 states. McGeveran said that, in general, state legislatures "are very accustomed to working with these uniform laws."
Noting that states are indeed active on privacy law but also divided on how to pass effective legislation, McGeveran believes the ULC’s process presents great opportunity for states.
"The approach would allow state legislatures to be in the driver’s seat much like they are now," McGeveran said. "This is an alternative where the legislature wouldn’t have to choose between moving away from uniformity or doing nothing. It’s a third option of moving in this space to regulate, but doing it in a way that doesn’t break from uniformity."
The CUPIDA project was taken up by the ULC after a research committee examined whether data privacy legislation was a state-level issue that required uniformity and a topic on which an adoptable bill could be introduced. Perlman, who was on the study committee, said it was clear data privacy met the ULC's criteria, but there was a choice to be made on the scope of their process.
"What we focused on was whether a more or less comprehensive personal data privacy act would be appropriate or whether we should do a more focused project," Perlman said. "We could’ve limited ourselves to biometric data, the internet of things or a look at data security issues. We went back and forth, but in the end, we decided to start with a more comprehensive approach. Seemed like the right thing to do."
Perlman noted the discussion draft presented at the first drafting meeting was "not a proposal" and that it was intended to "raise all the issues that could be considered." The current bill includes provisions on a consumer’s rights to transparency regarding how and why their data is being collected, opt out of certain data activities, and the right to have their data corrected or deleted.
The drafting committee pulled concepts from existing privacy laws, including the EU General Data Protection Regulation and California Consumer Privacy Act, along with current federal proposals and state proposals from Washington state and New York. However, McGeveran explained, the ULC’s bill is not any sort of copycat legislation.
"I would say you want a good balance of drawing on good ideas we see in existing privacy legislation while starting fresh," McGeveran said. "This won’t work if this bill is a Frankenstein monster stitched together from pieces of other proposals. It has to be coherent on its own. That’s going to require that fresh look, but we also don’t need to reinvent things that have been considered at length elsewhere."
Observers at the first drafting meeting were receptive to the ULC’s "blank page" approach.
"The discussion review of the bill was really thoughtful and cordial," Network Advertising Initiative Vice President of Public Policy David LeDuc said. "They tried to start with a basic but quite clean approach. There was a lot of talking through the same challenging issues that have been discussed and explored, but it’s the beginning of a long process where they’ll probably look to put more meat on the bones."
McGeveran and Perlman both alluded to the ULC’s goal of a transparent drafting process, which was evident at the first drafting meeting. World Privacy Forum Founder and Executive Director Pam Dixon said the committee set aside time at the beginning of the meeting for herself and fellow observers, including LeDuc and U.S. Federal Trade Commission Bureau of Consumer Protection Director Jessica Rich, to weigh in on their concerns with the discussion bill.
"The ULC process has restored my faith that we can have a civil dialogue around privacy," said Dixon, who added that she felt WPF’s CCPA comments were largely disregarded and unaccounted for in the end. "I was very interested in ensuring there was a clear conversation around some of the risks and vulnerabilities. I felt very heard in the conversation. No one said we couldn’t say certain things or that we needed to dismiss concerns about the structure of the draft."
According to Perlman, the ULC requires its bills to be read "line by line" at successive annual meetings before it can clear them for states to adopt. An amended version of the CUPIDA will be reviewed by the drafting committee and stakeholders at April’s drafting meeting and then undergo further revisions before its first annual meeting readout in July.
Photo by Ryoji Iwata on Unsplash
