Privacy & Information Security Law Blog

During the week of April 1, 2019, the Centre for Information Policy Leadership (“CIPL”) at Hunton Andrews Kurth LLP hosted its annual executive retreat in Washington, D.C. (the “Retreat”). During the Retreat, CIPL held a full-day working session on evolving technologies and a new U.S. privacy framework followed by a closed members only half-day roundtable on global privacy trends with special guest Helen Dixon, Data Protection Commissioner of Ireland.

CIPL Executive Retreat on a New U.S. Privacy Framework

On April 2, 2019, CIPL hosted a full-day working session on “Privacy Laws and Evolving Technologies and A New U.S. Privacy Framework” at Hunton Andrews Kurth’s D.C. office. Over 100 invited guests attended the working session, including CIPL members, U.S. regulators and policy makers.

The all-day event consisted of three main sessions. Following opening remarks by CIPL President Bojana Bellamy, the Retreat commenced with a panel on privacy laws and evolving technologies, moderated by CIPL Senior Policy Advisor, Fred Cate. Experts from leading technology companies discussed whether common privacy principles are relevant and adaptable to new technologies, including AI, Machine Learning, Blockchain and IoT. Participants discussed how mature models for applying privacy to evolving technologies generally do not yet exist and that more work needs to be done to find solutions. Challenges associated with traditional FIPPs based approaches were discussed, with a particular emphasis on the issues associated with notice and choice and the importance of transparency in the new world of data.

The second session of the day shifted to a discussion around a new U.S. privacy framework. The session, entitled “Learning from the GDPR – does it contain elements that should be included in a U.S. privacy law?” focused on the experience of companies over the past year with the GDPR. The panel, consisting of global privacy leaders of multinational organizations, discussed the positive impacts garnered from their GDPR compliance efforts and the return on investment they have seen over the past year. It also addressed elements of the GDPR that may not be appropriate for incorporation into a new U.S. framework without modification and adaptation to the U.S. legal system and culture. Participants also discussed the threshold question of which businesses should be covered by a new federal law and the importance of an accountability- and risk-based approach to any new privacy framework.

The final session of the event, entitled “What should a U.S. Privacy Law Look Like?” was split into two segments – a discussion with U.S. government and regulatory representatives, moderated by CIPL Vice President and Senior Policy Counselor, Markus Heyder, and an industry panel featuring a discussion by private sector representatives, moderated by CIPL Advisor, Russell Schrader.

The government panel featured speakers from the White House National Economic Council, the U.S. Federal Trade Commission, the U.S. Department of Commerce National Telecommunications and Information Administration (“NTIA”) and the National Institute of Standards and Technology (“NIST”). The importance of preemption to facilitate data flows and avoid an unmanageable patchwork of state laws was discussed along with the need to ensure a new U.S. framework meets the dual goals of protecting privacy and enabling innovation and the beneficial use of data. Preliminary findings from NTIA’s request for comment on Developing the Administration’s Approach to Consumer Privacy were outlined along with an explanation and status update of the new NIST privacy framework.

The industry panel was moderated by CIPL Advisor Russell Schrader and featured a discussion among U.S.-based industry leaders, as well as Hunton Andrews Kurth partner Lisa Sotto. Participants emphasized the unique opportunity presented to the U.S. to craft its own approach to privacy and that in creating a principles-based law, the elements of data stewardship must be broken down into concrete specifics. The GDPR and California Consumer Privacy Act of 2018 are helpful reference models but should not act as a shortcut in creating a new privacy law.

CIPL Post-Retreat Closed Roundtable

On April 3, 2019, CIPL hosted a closed post-retreat roundtable for its members on global privacy trends. The session commenced with a keynote on the “First Year of GDPR – Key Learnings and Priorities for Continued Implementation” by special guest Helen Dixon, Data Protection Commissioner of Ireland. Dixon outlined key areas of activity for her office over the past year, provided insight into challenges for regulators under the GDPR regime and discussed enforcement activity and expectations for organizations. A Q&A session followed the keynote. After a short break, CIPL held a members-only closed session on upcoming global privacy trends.