On June 5, 2019, the NY State Senate passed the Stop Hacks and Improve Electronic Data Security Act (SHIELD Act) to beef up its data breach notification law whereas a month earlier the New Jersey Governor signed into law an amendment to the New Jersey data breach notification law.  This is the first act in what may lead to significant new privacy laws emerging from these sister states.

New York now is now moving on a bill, S5642, that is even more protective than the California Consumer Privacy Act while New Jersey is in the process of merging two proposed bills that may lead in the same direction. There has been opposition to these proposed laws by those companies who have the most to lose by stringent data privacy controls.  

If passed, however, these new laws may actually prod Congress to finally move on a comprehensive privacy framework – one that might preempt aggressive laws such as the ones proposed by New York and New Jersey and the one already passed in California, in favor of a much more tempered approach.  

In other words, the Internet Association and its lobbying partners may actually win the war if these bills are enacted and it can just get Congress to act in a preemptive manner.  Thankfully, the momentum has been consistently on the side of consumer protection and any hope of bipartisan action on the part of Congress remains a long-shot given the current political environment.