Columbus, OH – On Thursday, The Buckeye Institute released a new policy brief, A Federalism Opportunity in A Congressional Failure: How States Can Fix the Data Privacy Patchwork, urging states—in the wake of Congress’s failure to adopt comprehensive data privacy legislation—to work together to harmonize state-level data privacy rules, which, if left unaddressed could cost businesses and consumers $98 billion to $112 billion annually.

“Despite broad agreement that the United States needs a federal data privacy law, efforts to pass comprehensive data privacy legislation at the federal level have been squandered,” said the paper’s author Logan Kolas, an economic policy analyst with the Economic Research Center at The Buckeye Institute. “However, as Congress dithers, states can and should take the lead and pass data privacy legislation that minimizes compliance costs while effectively protecting consumer data privacy.”

In the paper, Kolas notes that as of August 2023, “12 states have passed comprehensive data privacy laws” and that states will continue to adopt “well-intended data privacy regimes,” costing businesses and customers billions. Kolas outlines three commonsense approaches states should take to align their data privacy regimes. 

• States should incentivize businesses to comply with the National Institute of Standards and Technology (NIST) industry best practices by adopting an affirmative defense provision into law that says if companies can show that they have complied with the NIST standards, they can avoid legal penalties. 
• States should pursue data privacy agreements and multi-state compacts to remain compliant across multiple states and jurisdictions.
• States should pick and stick to a data privacy model, prioritize only the most necessary legal changes, and resist the temptation to diverge from a dominant model.

Without a coordinated approach such as the one outlined, Kolas warns, “businesses will face an increasingly complex and expensive web of bureaucratic requirements that will further concentrate the market, increase market uncertainty, and raise compliance and operating costs on businesses.”

# # #