Pick your aphorism.  Nature abhors a vacuum.  Markets hate uncertainty. Fools rush in where angels fear to tread.  Small is beautiful.  Whichever one you choose, my prediction for 2020 is the same:  we will see state legislatures acting to protect their citizens (and lure corporate taxpayers) by passing legislation aimed to plug the gaping holes gouged into existing law by tech.  And those efforts will be smaller-bore and more targeted than omnibus privacy bills like the CCPA. (All those who think we will see the federal government pass anything like GDPR here on a bipartisan basis anytime soon, see me after class.) States, it says here, will compete to address specific tech and data-related pain points of concern to their current and prospective taxpayers.   Much like the infamous “race to the bottom” for the most permissive corporation statutes in earlier years, states will attempt to add companies to their tax bases with friendlier tech legislation.

I think Ohio’s safe harbor law for data breach liability litigation was a bellwether.  Heretofore, the only thing we knew about data breach litigation is that whatever a company did to “harden” its defenses against unauthorized intrusions, it would be deemed woefully insufficient by a trier of fact in hindsight.  To give Ohio companies at least a puncher’s chance, Ohio passed a law that allows a company an affirmative defense based on the adoption of recognized security standards.  More on the Ohio safe harbor here.

Illinois gives us another, more recent example of a state setting ground rules for employers for the use of an emerging technology, in this case, AI, in hiring. Its “Artificial Intelligence Video Interview Act”, now in effect, requires notification to job applicants that AI will be used to consider their “fitness” for a position, an explanation of how the AI works, and what “general types of characteristics” the AI considers when evaluating candidates. The law also limits who can view an applicant’s recorded video interview and requires that companies delete any video that an applicant submits within a month of their request. You can learn more about the Act here. (Fairness dictates that I note here that Illinois is also the state that many corporations that use biometric data love to hate because of its private right of action for unconsented to collection of such data.  Read more here.) A foolish consistency is the hobgoblin of little minds.

To be sure, some states will continue their efforts to match or surpass California’s efforts to create a de facto national privacy standard (and we will continue to track those efforts here). Most, however, will think small and follow the money.  Which means more patchwork regulation to keep track of for us all in 2020 and beyond.  And there was much rejoicing.