“Perfect is the enemy of the good where it comes to regulation of data privacy rights,”  agree both Washington State Sen. Reuven Carlyle and California Supervising Deputy Attorney General Stacey Schesser in the International Association of Privacy Professionals panel, “State of the States.”

Per Carlyle

• The Washington Privacy Act (WPA) is coming back next year and in the meantime will hopefully continue to inspire other states.
• You need to figure out your focus: enforcement of the right of a particular individual or fixing systemic wrongs.
• Private right of action calls out the balance between the risk of over enforcement and under enforcement.

Per Schesser

• This is the “California Consumer Privacy Act” not the California Act of Businesses trying to mitigate risk, but actually pretty much doing the same thing as before.
• The right to cure has surprisingly proven an effective tool to provide companies with clarity.
• Dark patterns is a new area of proactive enforcement focus.

Per Colorado AG Phil Weiser:

• You need to balance between being over prescriptive and too vague when drafting legislation.
• The enforcement authority should have as many tools as possible, including something similar to the DOJ ‘no action letters’.