* * *
Which level is better placed to
provide efficient data protection – the federal or the state level? This
question is topical both in the United States and in the European Union. In the
US, there are concerns regarding the increased fragmentation of American data privacy
law and the lack of relevant federal consolidation. In the EU, the proposed
General Data Protection Regulation (GDPR) supposed to replace the Directive of
1995 was met with opposition regarding
the “over-centralization of powers” in the European institutions.
Where do we stand with data protection in the EU and in the
US now? We are five years in after the EU Commission first announced its
initiative to work toward updating the framework European data protection law,
and over 207 amendments to the Commission’s proposal later (introduced only in the
version of the European Parliament; if we add the ones tabled by the
different Presidencies of the Council, the count would reach several
thousands). In an unprecedented move, at the end of July the European
Data Protection Supervisor issued his own amended version of the
Regulation ahead of the upcoming institutional trialogue…
In the meantime, the US has been drifting further away from
a comprehensive statutory scheme after a federal proposal for a Consumer
Bill of Rights failed to muster agreement twice, first in 2012 and
then in 2015. Current attempts to regulatestudent
privacy and to consolidate state data
breach notification laws on the federal level remain uncertain.
In short, the GDPR and US federal initiatives are seemingly
not winning hearts and minds. But they should have at least provoked your
curiosity by now. Here is how federal or EU regulation has the potential of
bringing a level of legal certainty beneficial to individuals and businesses
alike:
The Evils of Centralizing Data Protection: Myth or
Reality?
Myth 1: The procedure for enacting US federal or European
law is slow and burdensome. Hence, the main fear of centralizing data
protection law is that it would bring regulatory ossification that stymies
innovation.
Myth 2: Industry lobbies mobilize better on the federal or
the EU level. They push Congress or the EU institutions toward the
establishment of weak centralized legislation vis-à-vis private sector
regulation. The phenomenon, dubbed “defensive preemption”,
has been described regarding policy developments in the US environmental field
back in the 1980s. Strong lobbies tried to preempt environmental-friendly US
state laws by institutionalizing a low bar of federal protection.
The conventional wisdom is not entirely wrong. But it is
simplified and too often incomplete. Precisely because of the checks and
balances that slow down US federal or EU lawmaking, state regulation is a
necessary backstop for data protection law. The state legislatures can react
promptly to what are perceived by their constituents as digital threats. Some
of the state laws will provide imperfect protection and will possibly be too inflexible.
Federal or EU law oversight can evaluate and fix such regulatory failures.
In turn, centralized oversight does not need to translate
into weakening of the privacy protections. Federal or EU law can introduce
mechanisms that allow the law to respond to ongoing challenges. For example,
the GDPR establishes a one-stop-shop mechanism that aims to avoid forum
shopping. According to the one-stop shop principle, only one national Data
Protection Authority (DPA) is responsible for taking legally binding decisions
against a company (the responsible DPA is determined by the company’s main
establishment in the EU). However, some were concerned that businesses would
locate their main establishment in countries with a less onerous enforcement
approach. Despite question marks about the practical
implementation of this principle, the GDPR introduces a requirement for
co-operation between the national DPAs that significantly minimizes the risk of
a “race to the bottom”.
One way to avoid ossification is therefore by relying on
state standards and institutions to act as catalysts. An often-quoted example
is the first Californian law on breach notifications, now adopted under one
form or another in 47 of the US states. A similar case is the French idea of a “droit
à l’oubli” that now forms part of the case
law of the European Court of Justice and is a feature of the GDPR. If
the federal government or the EU legislator refrain from preempting state law
for a period of time, at least some of the higher standards of consumer or
fundamental rights protection introduced in at least some of the states are
likely to be voluntarily taken up by other states but also by the industry.
Privacy federalism can offer protections in the long run.
No comments:
Post a Comment