The Challenge
In mid-2020, the U.S. faced a familiar roadblock: federal privacy legislation had stalled. The COVID-19 pandemic and social unrest shifted legislative focus, but the real issues were longstanding. Two main obstacles repeatedly halted progress: federal pre-emption of state privacy laws and the inclusion of a private right of action.
For your legal and compliance team, this wasn't just a political issue. You were juggling California Consumer Privacy Act requirements while other states drafted their own laws. Each new state law meant another compliance assessment, another set of disclosure requirements, and another consent mechanism to manage. Without federal legislation, planning beyond the next state legislative session was impossible.
The challenge wasn't technical or procedural. It was about bridging positions both sides saw as non-negotiable. One side insisted on federal pre-emption to create a single national standard. The other wanted individuals to retain the right to sue companies directly for privacy violations. Without compromise on these points, no comprehensive federal privacy bill would pass.
The Environment and Constraints
The 2020 legislative environment posed specific constraints. Bipartisan cooperation on privacy had existed before, but it required agreement on enforcement mechanisms and the balance between federal and state authority.
From a compliance perspective, you were operating in a federal regulatory vacuum while managing a growing patchwork of state requirements. California's law took effect in January 2020, and other states were drafting their own versions. Each framework had different definitions for personal information, applicability thresholds, and timelines for data subject rights.
The constraint wasn't just legislative. Your organization likely had systems built around sector-specific federal laws like the Health Insurance Portability and Accountability Act or the Gramm-Leach-Bliley Act. Any federal privacy framework would need to interact with these existing regimes. The question of pre-emption determined whether you'd need to maintain compliance programs for both federal baseline requirements and state-specific enhancements, or whether federal law would set a ceiling that states couldn't exceed.
The Approach Taken
Kerry's approach aimed to restart bipartisan conversations by proposing specific frameworks for the two deadlocked issues. Instead of advocating for one side, the report sought middle-ground solutions both parties could accept.
For federal pre-emption, this meant exploring models that would establish federal baseline protections while allowing states to regulate in specific areas or impose stricter requirements under defined circumstances. This structured pre-emption would give you clearer guidance on which obligations came from federal law and which remained subject to state variation.
On the private right of action, the approach involved examining enforcement mechanisms that would provide meaningful accountability without exposing companies to excessive litigation risks. This might include statutory damages with caps, requirements for cure periods before lawsuits could proceed, or hybrid models where regulatory enforcement remained primary but private action served as a backstop.
The strategy recognized that neither side would get everything they wanted. The goal was to identify what each side needed versus what they preferred, then build a framework around those core requirements.
Results and Metrics
Kerry's effort to reignite bipartisan discussions was an attempt to move past the stalemate, though specific legislative outcomes or timeline projections from this initiative aren't detailed.
For your compliance program, the result of continued gridlock is clear: you're maintaining separate compliance assessments for California, potentially other states, and sector-specific federal requirements. You're tracking which state laws apply to which processing activities based on consumer location, business presence, and revenue thresholds that vary by jurisdiction.
The cost isn't just operational. It's strategic. You can't build a three-year data governance roadmap when the regulatory landscape might shift fundamentally with federal legislation. You're making technology investments and process decisions knowing they might need revision if federal law passes.
Planning Under Uncertainty
From a compliance practitioner's perspective, the lesson is about planning under uncertainty. You can't wait for federal legislation to finalize your privacy program. You need to build frameworks that can adapt to either outcome: continued state-by-state regulation or eventual federal pre-emption.
This means implementing controls that satisfy the strictest current requirements while maintaining the flexibility to scale back if federal law pre-empts state provisions. It means documenting your Legal Obligation and Legitimate Interests assessments in ways that work under multiple regulatory scenarios. It means building consent management and data subject rights workflows that can accommodate different definitions and timelines without requiring complete redesigns.
Takeaways for Your Team
First, understand that the debate over federal pre-emption directly affects your compliance architecture. If federal law fully pre-empts state privacy regulations, you'll need one program. If it establishes a floor with state enhancements allowed, you'll need a tiered approach. Design your systems to accommodate both possibilities.
Second, track the private right of action debate because it changes your risk profile. Regulatory enforcement follows predictable patterns: investigations, findings, corrective action plans. Private litigation introduces different dynamics: class actions, discovery burdens, settlement pressures. Your incident response procedures and breach notification protocols need to account for both enforcement models.
Third, don't treat federal legislation as binary (it passes or it doesn't). The specific provisions matter more than the existence of a law. A federal bill with broad pre-emption and limited private action creates different obligations than one with narrow pre-emption and expansive litigation rights. Read the actual legislative text when bills advance, not just the summary talking points.
Finally, recognize that legislative gridlock is itself a compliance factor. You're not waiting for clarity. You're operating in an environment where the absence of federal legislation is the regulatory reality. Build your program for the patchwork that exists, not the unified framework you wish existed. When federal legislation passes, you'll adapt. Until then, you're managing multiple state regimes simultaneously.
