In July 2021, the Uniform Law Commission (ULC) voted to approve the Uniform Personal Data Protection Act (UPDPA), a model data privacy bill that, when finalized, will be promulgated to state legislatures across the United States for consideration and possible adoption as early as January 2022.
According to the ULC, the UPDPA was drafted to provide a "reasonable level of consumer protection without incurring the compliance and regulatory costs associated with some existing state regimes." Key features of this model legislation include:
- Data subject rights, such as the right to access and correct personal data and the right to nondiscrimination;
- A data practices framework, defining uses of data that are either compatible, incompatible, or prohibited under the UPDPA; and
- Enforcement and rulemaking by the state's attorney general.
The approval of the UPDPA marks a significant development in data privacy legislation in the United States. First, the UPDPA presents an opportunity for greater uniformity with regard to data privacy regulation. Because no comprehensive data privacy law exists at the federal level, states have enacted their own versions, including the landmark California Consumer Privacy Act of 2018 and, most recently, the Colorado Privacy Act and the Virginia Consumer Data Protection Act. This state-driven process has led to differing rights, requirements, and remedies across jurisdictions. Second, the UPDPA substantively departs from these existing state laws. The UPDPA employs a unique system of categorizing data practices as compatible, incompatible, or prohibited based on the likelihood that the data practice may benefit or harm a data subject, and the category in turn determines whether notice to or consent from the data subject is required.
The UPDPA may be a particularly influential template for states that have not yet legislated in this area. Since its inception in 1892, the ULC has promoted the uniform enactment of laws among states by drafting model legislation for issues that are interstate or common to multiple states. Composed of more than 350 lawyers, judges, law professors, and legislators, the ULC has historically played a pivotal role in developing state statutory law, including the Uniform Commercial Code and the Uniform Probate Code.
Companies handling personal data should stay apprised of developments with the UPDPA. Although it will not be ready for introduction in state legislatures until January 2022, the final version of the UPDPA's language, structure, and provisions may be a strong indicator of what future data privacy legislation will look like at the state level.