Data privacy law is coming, big tech privacy officers say

Keith Enright, chief privacy officer at Google in Mountain View, Calif., said the U.S. is closer to federal data privacy regulation than ever before, and pointed to the California state legislation as the reason why. CCPA, which was enacted a year ago, and the California Privacy Rights Act (CPRA), an expansion of CCPA that will take effect in 2023, provide a swatch of data protections for residents of the state, including the right to opt out of automated decision-making systems.

“If history is any lesson, that is going to be a catalyst for a tremendous amount of state-level legislative activity across the next couple of years that tends to dramatically increase the chances that we can develop the political will at the federal level to do something just to create a uniform rule of law so companies know what the rules of the road are and individual users know what their rights and protections are,” Enright said during a CES session.

Movement on enacting a data privacy law isn’t just happening at the state level. Congress, too, has had its eye on data protection for more than a year. The Senate Committee on Commerce, Science, and Transportation has been discussing the issue, including two draft bills on data privacy, one sponsored Damien Kieran, chief privacy officer at Twitter, said overarching federal data privacy regulation is “long overdue.”

“I think the stars have been aligned for some time, but perhaps now as a new administration comes in, we can see that change,” he said. Under the current administration, privacy regulations have sometimes moved in the opposite direction. In 2017, President Trump repealed a Federal Communications Commission law requiring broadband companies to get consumer consent on how data is used in advertising.

Anne Toth, director of Alexa Trust at Amazon, said she expects to see data privacy law advance under a Biden administration, particularly with Harris bringing her experience in pursuing consumer data rights to the administration.

“I would expect that there will be movement on this, and I would expect her … experience will come into play as they think through the administration’s approach,” Toth said.

Google’s Enright said it has always been a challenge for privacy professionals to ensure users understand how their data is collected and used, and what control they have over it. As the role of technology in people’s lives continues to grow, it becomes even more important for companies like Google to work with federal regulators and “identify opportunities where we can meaningfully improve the privacy and security that governs user behavior online,” Enright said.