Possible Increase in Federal and State Data Privacy Enforcement Actions in 2021

So far, 2021 is shaping up to be an important year for data privacy legislation. In March, Virginia enacted the Consumer Data Protection Act (CDPA) — the nation’s second comprehensive data privacy law. Dozens of state legislatures are actively considering data privacy bills, with California continuing to ramp up enforcement of the California Consumer Protection Act (CCPA). Meanwhile, with Democrats in control of both the White House and Congress, the prospects of a comprehensive federal data privacy law have increased, and the first data privacy bill introduced in this Congress holds promise as a possible law that could garner bipartisan support.[1]

With the increased focus on data privacy and proposed legislation, there is also reason to expect a significant increase in enforcement actions and resource allocation for protecting consumer data over the next few years.

The recently introduced data federal privacy bill — Representative DelBene’s (D-WA) Information Transparency and Personal Data Control Act, H.R. 1816 — would appropriate $350,000,000 to the FTC “for issues related to privacy and data security” and would require the FTC to “hire 500 new full-time employees to focus on privacy and data security, 50 of which shall have technology expertise.”[2]

To put this into prospective, the FTC’s fiscal year 2021 budget requests “a program level of $330,199,000 and 1,140 full-time equivalent positions,”[3] and the FTC’s Division of Privacy and Identity Protection, which oversees privacy related issues, only employed 40-45 full-time employees in 2020.[4] If passed, this federal privacy law would more than double the FTC’s resources for privacy-related enforcement — an area the FTC is already actively pursuing through current privacy-related laws.

At the same time, state regimes have already started to take action to increase funding and resources. In November 2020, California voters approved Proposition 24 — the California Privacy Rights Act (CPRA) — which amends the CCPA and creates the California Privacy Protection Agency (CPPA).[5] The CCPA is the first agency created in the U.S. for the sole purpose of protecting consumers’ privacy rights, and it has already been allocated $10 million in funding in the California governor’s proposed 2021-2022 budget.[6] The CPPA is expected to be aggressive in its enforcement of the CPRA and will likely impact all future state and federal privacy laws.

Similarly, the Virginia attorney general’s office will soon begin staffing in preparation to begin enforcing the CDPA in January 2023. While the CDPA does not provide any funding to the attorney general, it does establish a fund for civil penalties intended to support the attorney general’s enforcement of the CDPA. It is conceivable this self-funded approach may actually encourage the attorney general to be more aggressive in enforcing the CDPA (and collecting penalties) to ensure it has the necessary resources to protect consumer’s privacy rights in Virginia.

Based on the current climate and increased focus on data privacy at both a federal and state level, it is very possible that in the next few years, the U.S. will have both a comprehensive federal privacy regime with increased funding and resources to the FTC and a robust state-level privacy framework with increased funding and resources to state agencies.

Though a federal privacy law that includes preemption could change this course, the current direction of data privacy laws suggests that federal and state regulators will continue to throw more and more resources and funding at enforcing privacy laws. This begs the question: Will the number of enforcement actions ultimately be disproportionate to the needs of consumers?

[1] See Press Release, U.S. Congresswoman Suzan DelBene, “DelBene Introduces National Consumer Data Privacy Legislation” (Mar. 10, 2021), https://delbene.house.gov/news/documentsingle.aspx?DocumentID=2740.

[2] See H.R. 1816, 117th Cong. §6 (2021).

[3] See Federal Trade Commission, Financial Documents, “FY 2021 Congressional Budget Justification” (Feb. 10, 2020), available at https://www.ftc.gov/system/files/documents/reports/fy-2021-congressional-budget-justification/fy_2021_cbj_final.pdf.

[4] Federal Trade Commission, Report on Resources Used and Needed for Protecting Consumer Privacy and Security, 2020, available at https://www.ftc.gov/system/files/documents/reports/reports-response-senate-appropriations-committee-report-116-111-ftcs-use-its-authorities-resources/p065404reportresourcesprivacydatasecurity.pdf.

[5] Press Release, Office of Governor Gavin Newsom, “California Officials Announce California Privacy Protection Agency Board Appointments” (Mar. 17, 2021), https://www.gov.ca.gov/2021/03/17/california-officials-announce-california-privacy-protection-agency-board-appointments/.

[6] See Philip Y. Ting, Assembly Budget Committee Chair, “Highlights of Governor’s Proposed 2021-2022 Budget” (Jan. 8, 2021), available at https://www.troutman.com/images/content/2/8/280398/Highlights-of-the-Governors-Proposed-2021-22-Budget.pdf.