Enacting a “Light-Touch” US Data Privacy Law Instead of Copying Europe Could Protect Consumers and Save $116 Billion, ITIF Finds

WASHINGTON—Pressure is mounting for Congress to pass comprehensive data privacy legislation, as a growing patchwork of state laws burdens companies with multiple, duplicative compliance costs. Yet enacting a national law in the mold of Europe’s sweeping General Data Protection Directive (GDPR), as many privacy activists advocate, could cost the U.S. economy more than $122 billion per year, according to a new report from the Information Technology and Innovation Foundation (ITIF), the leading think tank for science and technology policy.

ITIF’s analysis concludes that maintaining America’s “light-touch” approach to data privacy by passing legislation tailored to address specific privacy-related harms would be effective in protecting consumers while costing only $6.5 billion per year, 95 percent less than a GDPR-style law. ITIF specifically recommends preempting state laws, distinguishing between sensitive and nonsensitive personal data, and rejecting a private right of action.

“Enacting a national privacy law is critical for the digital economy, because if you’re an organization that handles personal data, the current state of play is having to comply with a growing patchwork of state laws, which is driving up your costs and creating only confusion among consumers. But following Europe’s footsteps would be hugely expensive. Congress should strike a better balance by maintaining America’s lighter-touch approach to data protection,” said Ashley Johnson, a senior policy analyst at ITIF, who co-authored the new report. “Lawmakers recently introduced a comprehensive privacy bill—the American Data Privacy and Protection Act (ADPPA)—but there’s no consensus on many of its provisions, so it is unlikely to pass. The longer Congress delays on this, the more difficult it will be to reach a workable compromise. The best path forward is to pass targeted federal legislation that effectively addresses actual privacy harms while reducing costs that hinder productivity and innovation.”

ITIF’s cost analysis of national privacy legislation breaks down the direct complaince costs for businesses and the hidden indirect costs that a privacy law would impose on the economy by reducing productivity, and restricting data collection and sharing, which drives innovation. Under an overly broad law, consumers would face higher prices or new charges for services that previously were free—disproportionatly affecting low-income households—and begin to encounter a thicket of pop-up notices online due to transparency requirements.

The report finds that if Congress passes a privacy law that mimics the GDPR, it would cost $122.8 billion per year, including up to $106 billion in hidden indirect costs and up to $17 billion in direct compliance costs, whereas a more targeted, but still effective law would cost $6.5 billion per year.

ITIF argues that a targeted federal privacy law should still require privacy audits and give consumers more control over their data while relying on state and federal regulators to take action on any violations of the law. But the report says focusing regulations on sensitive data and preempting state and local privacy laws would significantly reduce costs.

“Congress should minimize both the direct compliance costs and the hidden costs by passing a targeted set of rules that effectively protect consumers from tangible privacy-related harms instead of an infinite set of hypotheticals as Europe does with the GDPR,” said Johnson. “Lawmakers need to strike a balance that benefits consumers and businesses and allows the data-driven Internet economy to continue to thrive.”

Read the report.