California Usurps Federal Privacy Action (Again)

Most Americans expect the federal government to be a party in international agreements regarding individual rights affecting U.S. citizens. However, in a peculiar (yet expected) twist, California has now teamed up with France on individual rights and data privacy protections. Specifically, on June 25, 2024, during an in-person meeting in Paris, the California Privacy Protection Agency (CPPA) and the Commission Nationale de l’Informatique et des Libertés (CNIL-France) signed a declaration of cooperation allowing these authorities to collaborate on efforts to safeguard personal information and advance privacy. 

This announcement came just prior to the last-minute, and unexpected, cancellation of an eagerly awaited scheduled markup of the federal proposed American Privacy Rights Act introduced in the U.S. House of Representatives and slated for discussion by the the House Committee on Energy and Commerce.

According to the International Association of Privacy Professionals staff reporting: “Energy and Commerce committee members and public observers were filing into the committee room as a House Republican staff member entered five minutes before the scheduled start of the markup to announce the cancellation. U.S. Reps. Anna Eshoo, D-Calif., and Russ Fulcher, R-Idaho, learned of the cancellation as public observers did, with Fulcher marked by frustration and Eshoo by shock.”

Federal lawmakers’ inability to move privacy forward has been seen as a glaring oversight and a missed opportunity to further both business and private interests around data collection and use.

Meanwhile, California law, French law, and the General Data Protection Regulation of the European Union all encourage international collaboration on privacy protections. This is the latest in a series of steps taken by the CPPA to work internationally, including previously joining the Asia Pacific Privacy Authorities (APPA) and the Global Privacy Enforcement Network (GPEN). In 2022 the Global Privacy Assembly admitted the CPPA as a full voting member (only the second U.S. organization to obtain that status).

California’s working relationship with other privacy regulators and data protection authorities may help move the needle towards a more cohesive set of privacy regulations globally. It will be interesting to see how these relationships will further shape California’s approach to privacy legislation and perhaps light a fire under federal legislators.