With two new U.S. State privacy laws, new Standard Contractual Clauses out of the EU, more GDPR-style laws passed around the globe, and record data protection fines, 2021 provided plenty of fodder for an end-of-year review.

U.S. Domestic: A Summary

Despite a growing consensus on the need for comprehensive privacy in the United States, lawmakers once again failed to make meaningful headway on the matter. While this might have been expected given the Biden administration’s continued attention on navigating the pandemic and its aftermath, many professionals had high hopes. 2021 seemed like it could be the year everything finally aligned to lead to a federal law. Broad public support…informed legislators…and an international call for the United States to act on privacy and data protection. That wasn’t the case.

However, while it wasn’t the year for privacy in the United States, considerable steps were taken. Most notably, Colorado and Virginia passed comprehensive privacy laws; the Federal Trade Commission (FTC) initiated the rule-making process to “curb lax security practices, limit abuses, and ensure that algorithmic decision-making does not result in unlawful discrimination”; and Congress held hearings on how to move forward with privacy and data security.

Perhaps the most significant takeaway from 2021 is the perspective we gained as various States became real-life testing grounds to uncover what elements of privacy law are palatable — or insurmountable. Successful legislation in the United States seems to offer some rights and protections for data subjects but remain business-friendly when compared with global counterparts. Above all else, legislation proposed across the States in 2021 proved how volatile four little words were for consensus: “private right to action.”

With little to no movement on the federal level, spectators of the privacy legislation theater are left to speculate that in order to provoke federal legislation, States will have (Read more...)