4 ms·
For those following along at home: So far five states have passed local Data Privacy laws (CA, VA, UT, CT, MA). They are all different. This situation makes it
by lmkg 4y ago
For those following along at home:
So far five states have passed local Data Privacy laws (CA, VA, UT, CT, MA). They are all different. This situation makes it much more likely that federal data privacy legislation will happen: while companies wish they could have 0 laws, they would still much rather prefer 1 law rather than 5 (trending towards 50) different laws that contradict each other.
There's a whole buncha specifics about what data is covered and what companies are covered and bleh blah bluh. That's not the most important thing. There are two things which are more important than that. These two issues also happen to be the topics most hotly debated between Dems & Repubs.
1. Private Right of Action, aka "Can I, a private citizen, sue someone?"
Everyone violates GDPR a dozen ways to Sunday, and nothing happens. Why? Because no one can actually enforce the law except for the local regulators who are underfunded. By contrast, the ADA lets anyone sue over violations, and as a result companies care a lot about handicap accessibility.
To my understanding the current negotiations are trending towards a limited Private Right of Action. Meaning it will exist for some violations but not others. This is how CCPA works in California right now: private citizens can sue over data breaches, but any other violation can only be enforced by the Office of the Attorney General.
2. Pre-emption, aka "Does this repeal CCPA."
Can states give additional protections to their residents, or is the Federal government removing the ability of states to define additional requirements for businesses. Again, the current state of negotiations seems to trend towards partial, but not total, pre-emption.
- encryptluks2 4y agoPartial preemption leads to supreme court decisions that lead to near total preemption.
- tomatotomato37 4y agoOnly if it's not a highly contentious issue. Otherwise the bigger states just go "We control X amount of the American population/economy, and thus we are going to enforce our own law anyway" Granted they would be in the wrong since this is clearly and unambiguously interstate commerce, but that hasn't stopped them before
- arrosenberg 4y agoIts not unambiguous. Google is based in CA, I am based in CA. Packets may go across state lines, but the commercial transaction (a search query) has occurred between two CA entities and should fall under state law.
- encryptluks2 4y agoIt doesn't work like that. Once Congress enacts something then it can be preempted by federal law. Just because the activity took place in a single state doesn't mean that the Federal courts don't have jurisdiction. Erisa is a good example.
- arrosenberg 4y agoI wasn't arguing that, I was saying that it's not an unambiguous case of interstate commerce. Congress shouldn't be pre-empting the laws of California insofar as they apply to intrastate commerce. You can set a federal minimum and let each state enhance laws as they see fit.
- encryptluks2 4y agoAgreed, but as we've seen with many other federal laws once you have preemption then it is usually interpreted to the broadest extent and not the minimum.
- rawgabbit 4y agoIs there a right, as a private individual, to sue everyone who has sent spam/fraud texts to me?
- lmkg 4y agoSpam email, yes, due to the CAN-SPAM Act explicitly authorizing it. I believe that at least one individual has literally made a living out of pursuing such lawsuits. Texts, nope.
- user3939382 4y ago> they would still much rather prefer 1 law rather than 5 (trending towards 50) different laws that contradict each other A perfect example of how these megacorps destroy the fabric of our political process. The fact that dealing with state regulations is a burden isn't our (the people's) problem, we have a right to have our state's reflect our will. They want to scale up to this massive size raking in billions of dollars, that should come with the territory.
- tzs 4y ago> Everyone violates GDPR a dozen ways to Sunday, and nothing happens. Why? Because no one can actually enforce the law except for the local regulators who are underfunded. Individuals can enforce GDPR in court: --------------- Art. 79 GDPR Right to an effective judicial remedy against a controller or processor 1. Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy where he or she considers that his or her rights under this Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with this Regulation. 2. Proceedings against a controller or a processor shall be brought before the courts of the Member State where the controller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where the data subject has his or her habitual residence, unless the controller or processor is a public authority of a Member State acting in the exercise of its public powers.