Photo: jijomathaidesigners/Shutterstock.com

Federal data privacy legislation is complicated, and passing a comprehensive federal data privacy bill will involve two polarized sides coming together on the issue of pre-emption over state laws and other federal laws that govern data by sector or industry, according to experts.

James Shreve, a partner and cybersecurity group chair at Thompson Coburn in Chicago, said Thursday one issue with data privacy legislation is that each bill on the subject may have to go through as many as six different committees on Capitol Hill before it heads to a vote.

“Then you layer on the fact that preemption is very contentious. It's a contentious issue on both sides of the aisle,” Shreve said.

There appears to be a switch in ideology. Democrats would like to see a federal data privacy bill that allows any existing or future state laws governing data privacy to remain intact. Meanwhile, Republicans, and the tech companies that support federal legislation, would like to see a federal law pre-empt state laws.

Shreve said he believes once other states see how the California Consumer Privacy Act works, they will follow suit.

Debra Farber, the senior director of privacy strategy at BigID, said it's good to know that companies are now taking data privacy seriously. However, with the CCPA coming into effect in 2020, the efforts on behalf of industry are too little too late.

“It used to be that all of the tech companies, which are largely libertarian-based, would fight against a federal law and said it would stifle innovation,” Farber said. “There is validity in the argument, but having told that story for so long and now all of the sudden turning around and embracing privacy and wanting federal legislation only because you don't want every single state to do what California did; it's just too little too late.”

Farber said it would make more sense for companies to advocate for more clarity in the CCPA and to make sure it would not impact smaller companies.

“The scope of it right now is what businesses are up in arms about because they feel like it is too vague and it encompasses too many small businesses,” Farber said.

Shreve explained that California was the first state to pass a data breach notification law and now all 50 states have data breach notification requirements on the books. Further, he said companies are perhaps fearful of the stringent requirements that the CCPA entails and how other states may copy those requirements.

“I think that's the case. California has certainly been a leader on privacy for many years,” Shreve said.

The CCPA provides stringent protections to consumers of companies doing business in California akin to those of the EU's General Data Protection Regulation.

“The requirements to the CCPA are just well beyond what we've seen up to this point. It's not an incremental step; it's a significant step,” Shreve said.

Farber said besides finding a consensus on pre-empting state laws that govern data privacy, there is also the issue of pre-empting the sector-by-sector data privacy laws already on the books.

“We have so many federal privacy laws in various different sectors,” Farber said. “In order to get a consensus on the federal level we'd have to re-architect all of the privacy laws that have different regulators based on different sectors.”