Data privacy is not only a matter of individual rights but also a matter of national security. The United States faces growing threats from foreign adversaries, especially China, seeking to exploit the vast amounts of personal data collected by American companies and platforms. The current patchwork of federal and state laws does not provide adequate protection for the data that fuels strategic technologies such as artificial intelligence, which have civilian and military applications. To enhance data security and safeguard national interests, the U.S. needs comprehensive federal privacy legislation that sets clear and consistent standards for collecting, using, and sharing personal information.
The challenges of data privacy and national security
The U.S. has long been a global leader in innovation and technology, but it also faces increasing competition and challenges from other countries, especially China. China has declared its ambition to become a world leader in artificial intelligence by 2030. It has invested heavily in developing and deploying AI technologies across various domains, such as surveillance, military, health, and education. China also has a different approach to data governance than the U.S., granting the Chinese Communist Party (CCP) sweeping powers to access and use data collected by domestic and foreign companies operating in China. The CCP has also engaged in widespread cyber espionage and theft of intellectual property from the U.S. and its allies, targeting both public and private entities.
On the other hand, the U.S. does not have a single, comprehensive federal law regulating the collection and use of personal information. Instead, it has a mix of laws that cover only specific sectors and types of sensitive information, such as health and financial data. These laws are often outdated, inconsistent, and overlapping, creating gaps and loopholes that leave many types of data unprotected or under-regulated. For example, the data collected by the vast majority of products and services people use daily, such as social media, e-commerce, and online search, is not subject to any specific federal privacy law. Moreover, these laws do not address the challenges posed by new technologies, such as facial recognition, biometrics, and the Internet of Things, that collect and process large amounts of personal data, often without the knowledge or consent of the users.
In the absence of a federal privacy law, some states have taken the initiative to enact their own privacy laws, such as the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (VCDPA). However, these state laws vary in scope, definitions, and enforcement mechanisms, creating a fragmented and confusing landscape for consumers and businesses. Furthermore, state laws alone cannot address the national security implications of data privacy, as they do not have the authority or the resources to regulate cross-border data flows, coordinate with foreign governments, or respond to cyberattacks by foreign actors.
The benefits of a federal privacy law
A federal privacy law would provide several benefits for the U.S. regarding data and national security. First, a federal privacy law would establish a uniform and consistent framework for protecting personal information, regardless of the data’s sector, type, or location. This would reduce the compliance costs and uncertainties for businesses, especially small and medium-sized enterprises, and foster innovation and competitiveness in the digital economy. It would also enhance consumer trust and confidence in the products and services they use and empower them to exercise more control and choice over their data.
Second, a federal privacy law would strengthen the U.S. position globally, especially in relation to China and the European Union. The U.S. currently lacks credibility and leverage in negotiating data protection agreements with other countries, as it does not have a comparable level of privacy protection as its trading partners. A federal privacy law would enable the U.S. to restore its leadership and influence in setting global data governance standards and norms and promote its values and interests in the digital domain. It would also facilitate data transfers and cooperation with allies and partners, especially in law enforcement, intelligence, and defense.
Third, a federal privacy law would enhance the U.S. resilience and response to the threats posed by foreign adversaries, especially China. A federal privacy law would limit foreign entities’ access and use of personal data and impose strict safeguards and accountability measures for data sharing and processing. It would also create a clear and effective mechanism for the government to coordinate with the private sector and other stakeholders in addressing data breaches, cyberattacks, and other incidents that may compromise data security and national security. Moreover, it would support developing and deploying strategic technologies, such as artificial intelligence, that rely on data and ensure that they are used responsibly and ethically and respect human rights and democratic values.
Data privacy and national security are closely intertwined in the digital age. The U.S. cannot afford to lag or lose its edge in the face of the growing challenges and opportunities posed by new technologies and foreign competitors. A comprehensive federal privacy law is a necessary and overdue step for the U.S. to protect its data, people, and national interests.
