Title: The Cybersecurity 202: Why a privacy law like GDPR would be a tough sell in the U.S. - The Washington Post
Headings: The Cybersecurity 202: Why a privacy law like GDPR would be a tough sell in the U.S.
The Cybersecurity 202: Why a privacy law like GDPR would be a tough sell in the U.S.
THE KEY
Today, the European Union cements its status as the global leader in data privacy.
In theory, there’s nothing preventing the United States from adopting a set of privacy standards that are just as broad and forceful. Indeed, many privacy advocates have called for it. But on this side of the Atlantic, it’s still kind of a data privacy free-for-all.
There’s no equivalent of the GDPR in the United States, nor is there likely to be one anytime soon. A mosaic of different state and federal rules, some of them varying widely, govern some of the same issues, but there’s no central authority that enforces them.
Does the United States need something similar? Depends on who you ask. But here are a few reasons a GDPR equivalent would be a hard sell here.
1. There’s no agency to carry it out.
2. Congress won’t go for it.
3. There’s not enough public demand for a data privacy overhaul...
... Or is there?
— As GDPR takes effect, you may be getting a flood of privacy policy updates in your inbox. Twitter had some fun with it:
PINGED: A woman in Portland, Ore., said the virtual assistant Alexa on an Amazon.com Echo device quietly recorded a conversation in her home and sent it to one of her husband's employees without their knowledge, The Washington Post's Hamza Shaban reports .
— More cybersecurity news from The Post and elsewhere:
— The Senate Armed Services Committee on Thursday approved a bill that would require companies doing business with the U.S. military to disclose whether the source code of the software that they're selling was reviewed by U.S. advseraries such as China or Russia, Reuters's Joel Schectman reports. The bill passed the committee in a 25-to-2 vote. Security experts say letting Russia examine the source code of software could allow it to discover weaknesses that it could take advantage of, according to Schectman.
— More cybersecurity news from the public sector:
— A lawsuit in California alleges that Facebook gathered extensive personal data through its apps from users and also collected information from some people who didn't have an account on the social network, the Guardian's Carole Cadwalladr and Emma Graham-Harrison report.
— Fraudulent transactions via mobile apps have increased by more than 600 percent in three years, according to a report by cybersecurity firm RSA released on Wednesday. “While part of this increase is likely attributed to greater digitalization of banking and other consumer services, it is clear the mobile channel is still more vulnerable to fraud and requires better protection,” RSA's Heidi Bleau wrote in a blog post.
— More cybersecurity news from the private sector:
Today
Coming soon

Content: “Even if the FTC were to use its rulemaking authority to promulgate a set of commands, there’s no public institution in the U.S. that has that breadth of authority, and that’s a big gap,” William Kovacic, a former general counsel, member and chair of the FTC during the Barack Obama and George W. Bush administrations, told me. Advertisement
Story continues below advertisement
Kovacic, a law professor at George Washington University, said other agencies such as the Education and Commerce Departments have data protection functions, and states have their own laws and regulations governing data privacy. But there’s no mechanism in the federal government to bring it under one roof. “In many ways we have an antiquated policymaking infrastructure,” Kovacic said. “ It’s a patchwork of controls that have no unifying principles and no unifying institutions to coordinate policy.” 2. Congress won’t go for it. It’s challenging enough to pass simple legislation in a gridlocked Congress. Getting something as complex as the GDPR approved would be a huge undertaking. Story continues below advertisement
Privacy legislation far less sweeping than the GDPR has stalled over and over in recent years.