Having escaped the bleak midwinter of the Midwest for a few brief days, I find myself sitting poolside in sunny Orlando experiencing a few tantalizing hours of near summer temps. As I watch the inflatables being splashed about gleefully by children (mine included) impervious to the water’s lingering chill, my thoughts naturally turn to privacy and security (which is not a euphemism for my ill-fitting swimsuit by the way).

If you can drive that latter image from your mind for a moment, please hear me out as I posit that our nation’s privacy laws are currently better likened to a beach ball than the oft-analogized patchwork quilt of the past. And here’s why – a quilt suggests a network of panels grafted together, arguably ever-expanding but not necessarily purposefully. It is cohesive only in the sense that it is stitched, and at best, two dimensional. A beach ball on the other hand is not formless but formed, with panels that, while colorful and independent, work together to create a three dimensional structure with a purpose. Now that all states have weighed in with privacy laws of their own, we’ve seen the ball round out into a predictable shape and size organically – each set of statutes and regulations contains essentially the same sort of duties, triggers and reporting requirements with only marginally nuanced variations.

Whether this structural integrity can be maintained is the challenge for 2019 as some states are starting to take a more assertive GDPR-like approach to privacy (which is increasingly viewed as a fundamental right) and implementing radically different and stronger protections over information relating to folks like you and me. California’s Consumer Privacy Act, passed in 2018 and slated to take effect in 2020 may be a bellwether in this regard. If it is and other states start to fall in line (see recent developments in South Carolina and Vermont and the NAIC Data Security Model Law by the way), it may test the strength of the privacy ball that began forming in 1890 when Louis Brandeis and Samuel Warren first asserted the right to be left alone in their Harvard Law Review article The Right to Privacy. If California’s actions do indeed portend coming attractions, expect Congress to weigh in sooner than later (as it has been rumbling to do for many months) with an omnibus federal law intended to ensure that our uniquely developed privacy ball doesn’t come apart at the seams.