"It is one of the happy incidents of the federal system that a single courageous State may, if its citizens choose, serve as a laboratory; and try novel social and economic experiments without risk to the rest of the country."
--New State Ice Co. v. Liebmann, 285 U.S. 262, 311 (1932) (Brandeis, J., dissenting).
EPIC's State Policy project, launched in the Spring of 2015, provides expertise to shape strong state privacy and open government laws.
State Policy News
- California Passes Milestone Privacy Law: The State of California has enacted the California Consumer Privacy Act of 2018, the most comprehensive consumer privacy state law ever enacted in the United States. The Act will establish the right of residents of California to know what personal information about them is being collected; to know whether their information is sold or disclosed and to whom; to limit the sale of personal information to others; to access their information held by others; and to obtain equal service and price, even if they exercise their privacy rights. The Act will allow individuals to delete their data and it will establish opt-in consent for those under 16. The Consumer Privacy Act provides for enforcement by the Attorney General, a private right of action, and will establish a Consumer Privacy Fund to support the purposes of Act. The California Consumer Privacy Act of 2018 follows a California ballot initiative that gathered over 600,000 signatures. After the Equifax data breach, EPIC testified in the U.S. Senate that comprehensive privacy legislation was long overdue. The EPIC State Policy Project also provides expertise to the states to help shape strong privacy laws. (Jun. 28, 2018)
- EPIC to UK Privacy Commissioner: Data Protection Assessments Require Algorithmic Transparency: EPIC has submitted extensive comments on proposed guidance for Data Protection Impact Assessments. The new European Union privacy law - the "GDPR" — requires organizations to carefully assess the collection and use of personal data. In comments to UK privacy commissioner, EPIC said that disclosure of the technique for decision making is a core requirement for Data Protection Impact Assessments. EPIC supports "Algorithmic Transparency". EPIC has pursued criminal justice FOIA cases, and FTC consumer consumer complaints to promote transparency and accountability. EPIC has warned Congress of the risks of "citizen scoring." (Apr. 13, 2018)
- Court Rules Secret Scoring of Teachers Unconstitutional (Jun. 13, 2017) +
- EPIC Urges Massachusetts High Court to Protect Email Privacy (Oct. 24, 2016) +
- Massachusetts Court Upholds Privacy Rights of Cell Phone Users (Sep. 28, 2016) +
- Secret Ballot At Risk in Maryland After Election Board Vote (Sep. 27, 2016) +
- EPIC, Verified Voting, Common Cause Release Report on Ballot Secrecy (Aug. 18, 2016) +
- EPIC Urges Wisconsin Legislature to Safeguard Student Privacy (Aug. 17, 2016) +
- States Adopt New Student Privacy Safeguards (Jun. 21, 2016) +
- Amendment Would Overturn Model Facial Recognition Privacy Law (May. 27, 2016) +
- NY Attorney General Reports 40% Increase in Data Breaches (May. 5, 2016) +
- Privacy in the States: Data Breach Notification in TN, Drone Surveillance in OR (Apr. 15, 2016) +
- EPIC to Testify before Pennsylvania Senate on Domestic Drone Surveillance (Mar. 14, 2016) +
- EPIC FOIA - Information about Controversial DNA Forensic Technique Released (Feb. 23, 2016) +
- California AG Releases 2016 Data Breach Report, Retail and Financial Sectors Most Vulnerable (Feb. 18, 2016) +
- In Court: EPIC Urges Massachusetts to Protect Student Privacy (Nov. 23, 2015) +
- EPIC Obtains Documents on Secret DNA Forensic Source Code (Nov. 10, 2015) +
- New Mexico Supreme Court Finds Warrantless Aerial Surveillance Violates Fourth Amendment (Oct. 19, 2015) +
- EPIC Pursues Public Release of Secret DNA Forensic Source Code (Oct. 14, 2015) +
- California Rejects Warrantless Surveillance, Enacts "CalECPA" (Oct. 9, 2015) +
- California Enacts Innovative Privacy Protections for Drones and SmartTVs (Oct. 9, 2015) +
- EPIC Urges Wisconsin to Protect SSNs of Job Seekers (Sep. 15, 2015) +
- In the States: California Governor Vetoes Drone Privacy Bill (Sep. 14, 2015) +
- In the States: Delaware Enacts Several Privacy Laws (Aug. 10, 2015) +
- In the States: NH Adopts Location Privacy Law (Jul. 28, 2015) +
- States Adopt Privacy Laws for Student Data, Breach Notification, License Plate Readers, and Drones (Jul. 2, 2015) +
- EPIC Urges California Supreme Court to Protect Open Records Law (Jun. 25, 2015) +
- South Carolina Requires Police Body Cameras, But Blocks Public Access to Footage (Jun. 12, 2015) +
- Florida Blocks Public Access to Police Body Camera Footage (May. 27, 2015) +
- California AG Urges Congress to Reform Data Breach Notification Bill (May. 21, 2015) +
- New Drone Privacy Law Signed by Florida Governor (May. 17, 2015) +
- EPIC Comments on Maryland Drone Bill (Mar. 17, 2015) +
More top news
- EPIC: Privacy Issues A-Z
- Privacy Journal: Compilation of State and Federal Privacy Laws
- National Conference of State Legislatures (NCSL): NCSL provides research and tools for state legislatures and others interested in state-level policy on a wide range of topics, including telecommunications and information technology.
- Council of State Governments (SGA): CSG is a region-based forum that fosters the exchange of insights and ideas to help state officials shape public policy.
- National Governor's Association (NGA): The NGA is the bipartisan organization of the nation’s governors.
- National Association of Attorneys General (NAAG): The NAAG is the bipartisan organization of the nation’s attorneys general.
- National League of Cities (NLC): The NLC is a resource for idea-sharing among cities nationwide.
- The United States Conference of Mayors (UCSM): USCM is the official non-partisan organization of cities with populations of 30,000 or more.
- OpenStates.org: OpenStates.org, a project of the Sunlight Foundation, is a collection of tools that make it possible for citizens to track what is happening in state legislatures by aggregating information from all 50 states, Washington D.C., and Puerto Rico.
- LegiNation: LegiNation is a legislative tracking resource which provides great tools for creating bill sheets and receiving updates on tracked bills via e-mail.
- GovTrack: GovTrack now provides tracking services of state bills in addition to bills filed in Congress. It uses a combination of data from LegiNation, and LegiScan, Inc, as well as some information from Open States.
In the context of legislation, preemption refers to whether a law restricts the authority of states, counties, or cities to enact or enforce their own policies. Preemption is an issue of legislative power--if the federal government preempts the states on a field of law, that action effectively expands the jurisdiction of Congress to the detriment of states and local governments. Congress' power to preempt state and local laws stems from the Supremacy Clause of the U.S. Constitution.
Federal preemption can take two forms--federal floor and federal ceiling preemption. In most consumer and civil rights legislation, federal law serves as a floor of protections. This "federal floor preemption" only supersedes weaker state laws, and it allows states, counties, and local governments to pass stronger laws. Under federal floor preemption, federal law only supersedes state and local law that conflicts with or is contrary to federal law.
Historically Privacy Law Allows States to Provide Greater Protections
In privacy and consumer protection law, federal ceiling preemption is an aberration. Historically, federal privacy laws have not preempted stronger state protections or enforcement efforts. Federal consumer protection and privacy laws, as a general matter, operate as regulatory baselines and do not prevent states from enacting and enforcing stronger state statutes. The Electronic Communications Privacy Act, the Right to Financial Privacy Act, the Cable Communications Privacy Act, the Video Privacy Protection Act, the Employee Polygraph Protection Act, the Telephone Consumer Protection Act, the Driver's Privacy Protection Act, and the Gramm-Leach-Bliley Act all allow states to craft protections that exceed federal law.
Although the federal government has enacted privacy laws, most privacy legislation in the United States is enacted at the state level. Many states have privacy legislation on employment privacy (drug testing, background checks, employment records), Social Security Numbers, video rental data, credit reporting, cable television records, arrest and conviction records, student records, tax records, wiretapping, video surveillance, identity theft, library records, financial records, insurance records, privileges (relationships between individuals that entitle communications to privacy), and medical records.
The National Association of Attorneys General Privacy Subcommittee has also argued that the states have a traditional role in regulating privacy:
Consumer protection has traditionally been an area where the states' power to ensure fair competition and informed consumer choice has been preserved, not eliminated. This structure has worked well for many years and no need to alter it in the area of privacy has been demonstrated. Preemption of state law will only undermine consumer confidence in their dealings with the financial institutions, e-tailers and other on and offline businesses. This conclusion is especially powerful with respect to financial information, where Congress has already recognized the utility of privacy protections enacted at the state level.
There is a presumption in American law that state and local governments are primarily responsible for matters of health and safety. Hillsborough County v. Automated Medical Laboratories, 471 U.S. 707 (1985) (there is a "presumption that state or local regulation of matters related to health and safety is not invalidated under the Supremacy Clause"). Privacy is included in the category of health and safety issues as an area of regulation historically left to the states. For instance, in Hill v. Colorado, the Supreme Court upheld a law protecting the privacy and autonomy of individuals seeking medical care, as the law was intended to serve the "traditional exercise of the States' 'police power to protect the health and safety of their citizens.'" 530 U.S. 703 (2000).
EPIC's previous work on preemption
EPIC has previously argued against federal ceiling preemption. EPIC has testified before Congress that, particularly in the rapidly changing world of information security, the states must be given room to innovate:
"Because states enjoy a unique perspective that allows them to craft innovative programs to protect consumers, they should be permitted to continue to operate as "laboratories of democracy" in the privacy and data security arena. State legislatures are closer to their constituents and the entities they regulate; they are the first to see trends and problems, and are well-suited to address new challenges and opportunities that arise from evolving technologies and business practices. This is why privacy bills have typically created a federal baseline and allowed the states to adopt more stringent safeguards if they wish.
There is an additional reason that we believe weighs against preemption in the information security field: these problems are rapidly changing and the states need the ability to respond as new challenges emerge." (Source)
EPIC has also argued against preemption in federal court. In ABA v. Brown (formerly ABA v. Lockyer), financial services companies sued to invalidate the California Financial Information Privacy Act, the strongest financial privacy protection in the nation at the time, arguing that the law was preempted by the federal Fair Credit Reporting Act. EPIC and a coalition of groups representing 41 million individuals argued in an amicus brief that preemption of state law weakens protections against identity theft and consumer privacy. The Supreme Court ultimately upheld the California law.
Additional EPIC statements on preemption:
- EPIC's testimony on the SAFE Data Act before the U.S. House Committee on Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade. (2011)
- EPIC's testimony on Identity Theft: A Victim's Bill of Rights before the U.S. House Committee on Oversight and Government Reform, Information Policy, Census and National Archives Subcommittee. (2009)
- EPIC's comments to the FCC opposing preemption of junk fax laws. (2006)
- EPIC's comments urging the FCC not to preempt strong anti-telemarketing laws. (2005)
- EPIC's ABA v. Brown Amicus brief opposing preemption. (2004)
- EPIC comments to the Office of the Comptroller of the Currency on Rules, Policies, and Procedures for Corporate Activities; Bank Activities and Operations; Real Estate Lending and Appraisals, Docket No. 03-02. (2003).
- EPIC's testimony, Consumer Privacy Protection Act of 2002, HR 4678, before the Subcommittee on Commerce, Trade and Consumer Protection, House Committee on Energy and Commerce. (2002).
- EPIC's testimony, Hearing on Privacy in the Commercial World, before the Subcommittee on Commerce, Trade, and Consumer Protection Committee on Energy and Commerce U.S. House of Representatives. (2001).
If you have questions, please contact EPIC's State Policy Coordinator.
Share this page:
EPIC relies on support from individual donors to pursue our work.
Subscribe to the EPIC Alert
The EPIC Alert is a biweekly newsletter highlighting emerging privacy issues.