The IAPP has seen its fair share of changes over 20 years of existence. The participation from Kirk Nahra, CIPP/US, is not among them.

Nahra, co-chair of WilmerHale's Cybersecurity and Privacy practice, said he has been involved with the IAPP since the start, noting he was once asked to be the editor of The Privacy Advisor in the IAPP's infancy. There isn't much Nahra hasn't done with the organization, serving on the IAPP board of directors and partaking in other organizational activities, including the Privacy Bar Section. Nahra currently sits on the Publications Advisory Board.

Kirk Nahra, CIPP/US

"It's been a great part of my professional experience for the past 20 years," Nahra said. "It has been a pleasure to meet both my peers in this area through IAPP and to get to know an impressive new generation of privacy pros in recent years, across the country and even around the world."

In this Volunteer Spotlight, Nahra dives into his observations on the U.S. state privacy law landscape, discussing current proposals, effects of a potential patchwork, how to approach compliance and more. 

The Privacy Advisor: How surprised are you that so many state Legislatures are not only tackling privacy legislation, but also giving more consideration than ever before? What do you think has really forced their hand? 

Nahra: The state role has been a bit odd for several years. States have been passing all kinds of laws, covering a wide variety of data, in areas such as biometrics, facial recognition, genetic data, health data and the like. The California Consumer Privacy Act generated a new kind of discussion — a general, overall privacy law at the state level. It's proven to be much harder to pass a similar law than many thought. The CCPA process was unique and won't be replicated in other states, and the substance is really hard. So states have been interested but haven’t had the right vehicle yet — and then COVID-19 shut everything down.

What we are seeing now is renewed attention, now that some other things besides COVID-19 are being discussed. The “problem” now — although it's not really a problem — is that nothing is forcing lawmakers' hands. A state privacy law is a potentially useful gap-filler in the existing privacy ecosystem. There are lots of laws now and lots of enforcement possibilities, and the states may not really view this as a state issue.

The Privacy Advisor: Folks are noting the evolution of the “look-alike bill,” meaning a lot of these bills are forged from the same template (i.e., CCPA, Washington Privacy Act, etcetera). Could such a phenomenon push federal privacy legislation further down the road? Why or why not?

Nahra: I think one of the difficulties is that there actually isn’t a good state law model at this point. My personal view is that the CCPA is kind of a mess, regardless of what you think of what is trying to be accomplished with it. It isn’t drafted well, which isn’t surprising given that it was essentially written in two weeks. The amendments have complicated things and then the California Privacy Rights Act is thrown on top of that before we have figured out the other stuff. So I think that a better model might actually help the states move forward. 

The Privacy Advisor: Virginia is on the verge of making it to the finish line with privacy legislation. What’s your view on the top positive and negative aspects of the Consumer Data Protection Act?

Nahra: Virginia sort of came out of the blue. It's an interesting case study. It may provide some motivation and encouragement to other states as far as seeing that this kind of law can actually get through a Legislature. At the same time, depending on your perspective, it's not necessarily a particularly good law. Lots of consumer groups don’t believe it goes far enough, and those efforts may create more impediments in other states. I look at the enormous exceptions that are built into the law's coverage and worry about how companies will manage the different rules in different contexts. I also worry about how this kind of complexity will actually help consumers understand anything about how their data is being used. Ultimately, the current approach, which comes across in both CCPA and the Virginia law, may be a lose-lose for consumers and companies. 

The Privacy Advisor: While much attention is being paid to Virginia and efforts in Washington state, is there another state you think is worth keeping an eye on as the next shoe to drop?

Nahra: It's really hard to tell. Oklahoma is moving along. New York has a number of different bills in play. Florida has started to review a law. I think we are going to see fits and starts in lots of states, but I don't think it's likely we see a lot of “overall” bills make it through this year. We may see other smaller laws instead, like facial recognition laws or laws focused on other more specific data categories. Those may be useful in context, but they'll serve to make the overall environment more complicated and harder to understand. While a great result for privacy lawyers and privacy professionals, probably not for companies or consumers. 

The Privacy Advisor: With compliance, what's your best advice for companies that are dreading the thought of a potential patchwork of U.S. state laws?

Nahra: I think the patchwork — once it hits three to five states beyond California that have actual laws in place — will put much more pressure on U.S. Congress to act. And I think corporate America is going to have to get behind a meaningful federal law to manage the increasing state complexity. With each new state, the baseline standard for that law rises.

There are lots of components of a meaningful privacy law where companies can manage and would support and also where consistency and clarity are more important than the underlying standard. There are also some much tougher issues — preemption will most likely be a necessity and the companies will take a hard line on a private cause of action. The biggest challenge in Congress will be to find compromises on these points.

The sleeper issue from my perspective is how a federal law will treat all the other existing federal laws. The state laws and most current federal laws carve out the coverage of current U.S. privacy laws. That’s going to result in a continuing patchwork, and I hope both companies and consumers are aware of the problems that exist because of it.

Preemption of state law is part of solving this problem, but a similar idea at the federal level is also quite important. For now, while managing the CCPA and one or two other states, be thoughtful, recognize the main risk areas, don’t do visibly bad things, and be patient with partners and customers. But as the state laws multiply, doing all that will get much harder.

The Privacy Advisor: Considering the attention being paid to state laws and EU-U.S. data transfers, what is the most under-reported privacy matter right now, and why does it deserve more attention?

Nahra: I think people really missing what the state laws are doing. They are not overall privacy laws in the way the EU General Data Protection Regulation is. The GDPR covers all data in all situations. The states are definitely providing some protections for some data in some contexts where there are not laws today, but the carve-outs and exemptions are enormous, creating patchworks even within states. I’ve been using a specific CCPA example, but this is relevant in Virginia, as well. If you are a California resident, your health data is covered by at least six different regulatory regimes — Health Insurance Portability and Accountability Act, the Confidentiality of Medical Information Act, the Common Rule for medical research, etcetera. That means that the protections for your data depend on a whole variety of issues.

The other issue in my mind is how COVID-19 has impacted this debate.

We learned how so much of the COVID-19 data falls into gaps today in U.S. privacy law — and is still in those gaps even after the CCPA, including all the data on the health of employees. At the same time, we don’t really have a good way in or a privacy law to consider the impact of COVID-19 issues on other people. For example, most privacy laws regulate a business in how the business relates to consumers. We don’t have a way to factor in the interests of other people in your data. I may not have an interest in your bank account, but I absolutely have an interest in your health status if you are in my office, a guest in my hotel, coming into a room with me or whatever.

That’s something that we have been addressing this year through common sense and thoughtful consideration of privacy overall, but it's an area with very little legal guidance. It's not clear that these new laws being considered will add guidance in any meaningful way.

Photo by Keagan Henman on Unsplash