Data Privacy Landscape Changing Fast

Unlike Europe, with its General Data Privacy Regulation, the U.S. has no single major “harmonizing” data privacy law. That may change, but in the meantime organizations must take into account a patchwork of local, state and federal laws that address specific aspects of the larger issue. Many U.S. companies also must heed the GDPR itself, which long with its extraordinarily high penalties (up to four percent of a company’s revenue) is noteworthy because of its explicit extraterritorial reach: It governs data protection of people in the EU, no matter where that data “resides.” For the future, prospects for some kind of federal data privacy legislation in the U.S. are fairly good, writes attorney and law school professor Debbie Reynolds in this Today’s General Counsel article. However, she notes, this will not necessarily stop states from coming up with their own laws.