A Rising Tide Lifts All Consumers: Penumbras of Foreign Data Protection Laws in the United States

Abstract

With the growth of collecting, processing, and transferring personal information to third parties, consumers’ data is increasingly exposed to a myriad of risks. Perhaps chief among these are the data protection practices of data collectors themselves. Yet despite the risk to consumers, U.S. data protection law has remained fragmented, focused on individual industries at the federal law and only made comprehensive, occasionally, at the state level. This lack of a comprehensive data protection law in the United States is a significant detriment to the security of U.S. consumers. International law also offers no such path that could comprehensively protect U.S. consumers.

Yet U.S. consumers’ personal information is receiving additional protections from an unlikely source: foreign data protection laws. There is a growing global trend to adopt comprehensive data protection laws, with the European Union, Brazil, Japan, and others adopting such legislation in the past few years. This article examines nine of these laws from five different continents, looking at the global trends and disparities shown by this sample. The influence of these nine laws and other legislation creates distinct soft law benefits for U.S. consumers. They do this chiefly through economic pressures for U.S. data collectors to adopt a one-size-fits all approach, social pressures from increased privacy awareness by consumers, political pressures for the U.S. to adopt equivalent national legislation, and practical benefits from having a variety of different foreign models to observe and select. While reliance on foreign data protection laws is not a substitute for the United States adopting its own comprehensive federal data protection law, these penumbras that spill over from foreign data protection laws offer largely unexamined, but significant benefits for U.S. consumers.