Reactions to the presidential election.
Dave Bittner: Hello, everyone, and welcome to "Caveat", N2K's CyberWire's Privacy Surveillance Law and Policy Podcast. I'm Dave Bittner, and joining me is my co-host, Ben Yelin, from the University of Maryland Center for Health and Homeland Security. Hey there, Ben.
Ben Yelin: Hello, Dave.
Dave Bittner: On today's show, Ben and I share our reactions to the presidential election. And later, on the show, my conversation with Sarah Hutchins, she's a partner at Parker Poe. We're discussing the growing number of state data privacy laws, litigation trends related to targeted advertising and wiretapping, and some of the key takeaways for companies on cybersecurity practices and risk reporting. While this show covers legal topics and Ben is a lawyer, the views expressed do not constitute legal advice. For official legal advice on any of the topics we cover, please contact your attorney. All right, Ben, we are going to stray from our usual format here of each of us bringing a story to the table here because I think it's fair to say that there is one big story this week, and that, of course, is the results of the presidential election. Donald Trump winning decisively, I think for many of us, myself included, I'm curious to get your take on this, surprisingly decisively. I think we were led to believe, and for a variety of reasons I believe, that it was going to be a closer game than it was, but Trump really had a decisive win here.
Ben Yelin: Yeah, he really did, he cleaned up. I think it's worth noting that the final popular vote margin will be Trump by about 1.5%, which is historically relatively small for an election winner, but everybody expected, even if President former and future President Trump won the Electoral College, that Vice President Harris would have won the popular vote, and she didn't. He won it. He made remarkable gains with a bunch of different demographic groups, really across the board. I think most states swayed from Biden's 2020 margin, about six points to the right on average. So it was a pretty broad, decisive victory. And there are a million different explanations for it. Probably the most persuasive to me is just part of a global trend of incumbents going down, the post-COVID period of high inflation, high interest rates, high costs, just kind of putting voters in a sour mood. That was evident from all the polling, and I think the signs were there for us. And, you know, whether we were looking elsewhere or had rose-colored glasses or something, I think that ended up being the story of the elections, just people's unhappiness with the economy.
Dave Bittner: Yeah, it strikes me, I think this is another example of perhaps polling not being as reliable as it used to be.
Ben Yelin: Yeah, I mean, I think people have too high expectations for polling. Really polling missed by a historically small margin. I think polling was off by maybe two to three points in the swing states, maybe two to three points nationally, which is a normal polling error. I just think people falsely expect that polling is going to create an extremely accurate picture. And just because of sampling error, it's impossible for polls to do that. What people like Nate Silver have tried to do is put things in probabilistic terms. He had it as about a 50/50 election. The most likely map that he had was Trump sweeping all the swing states, which is exactly what happened. So, certainly, the evidence was out there that this was going to be close. Trump had certain advantages. I think people thought he had a small advantage in the Electoral College. And then if the election was a referendum on the economy, he certainly had an advantage there. And I think the polls said that pretty much all the way. Some of us probably paid too much attention to historical indicators that did not pan out. So as a political nerd, there are a couple of things. There's-- if you look at the Washington state primary, they have an all-party primary. So you can vote for anybody in the primary election, the top two candidates advance to the general election. And traditionally, the margin in Washington has been indicative of the national mood. And so that pointed to a national mood that was favorable to Democrats, not the case. And then the other one was a poll out of Iowa by a very prolific pollster who had a certain mystique to her by the name of Ann Selzer. And three days before the election, she put out a poll saying that Kamala Harris was winning by three in Iowa, which I think opened a lot of people's eyes, maybe the pollsters were missing something. She's gone against the grain in the past. Turns out she was just way, way off. Donald Trump won Iowa by 13 points.
Dave Bittner: Wow. Way off.
Ben Yelin: Yeah, I'm taking out my calculator, that was a 16-point polling miss. So I think, it's one of those, the best thing you could have done instead of looking at the polls is just look at the fundamentals. People were unhappy with the economy, thought the country was going on the wrong track. Like in all countries around the world that are governed by right-wing or left-wing parties, there's a backlash against the people in power. And that worked to President Trump's advantage. And I think that's why he won.
Dave Bittner: Yeah. Well, I mean, let's talk about where we're headed then. I mean, obviously, we've got a couple of months before President Trump takes office once again here. In your estimation, what sort of things are going on in Washington to Prepare for that?
Ben Yelin: So I think there's a lot going on at federal agencies to kind of prepare for a Trump administration. You've heard rumblings about the Department of Justice. There being trainings about following presidential orders and how much authority does the president have vis-a-vis pre-existing law and precedent. You've heard that about the Pentagon, they've had trainings on what happens if the president gives us an illegal order. And then part of what got publicized before the election, the so-called Project 2025, was a plan to really gut a lot of the civil service in this country, to take away a lot of career bureaucrats who have been derisively called part of the deep state that aren't pushing forward President Trump's agenda. So, I think the most important thing to look out for during the transition at the beginning of the administration is how much does Trump follow through on his plans to remake the civil service. Obviously, there's going to be political leadership at the top, there always is, but how aggressive is that political leadership going to be in replacing staff at some of these key agencies? In terms of the area that we focus on this podcast -- cybersecurity, data privacy -- I think there are a lot of interesting elements to look out for. One is the approach to international threats. We certainly still face significant cyber threats from our foreign adversaries, Russia, China. I think everybody knows about Trump's relationship with Russia. It'll be interesting to see how that develops. Certainly, he's more favorable to the Russian government than the current administration. But I think he's more hostile in many ways to some of our other adversaries, including Iran and especially China. Some of the early personnel that he's picked, including Senator Marco Rubio as Secretary of State a pretty hawkish on China. So, it'll be interesting to see if that becomes a posture of the Trump administration, especially as it relates to China's plans vis-a-vis Taiwan. So I think what we're going to be paying attention to in terms of personnel in the next couple of months is does he continue to go down this rather hawkish route, which I think would manifest itself in our cybersecurity posture if we're going to be aggressive in rooting out cyber threats from foreign actors, or is he going to go in a different direction and pick people who are more anti-establishment, opposed to the general national security, defense apparatus, and Washington DC as he kind of promised. So I think that's unclear at this point.
Dave Bittner: Yeah, I wonder, you know, how was he going to approach organizations like CISA? You know, at the end of his first term, of course, he was unhappy with a lot of the folks in cybersecurity. I think largely because they were reiterating that the election was secure and legitimate and proper.
Ben Yelin: Yep. Got the head of CISA fired by tweet, if I recall correctly.
Dave Bittner: That's right. But we're in a different place now, right? I mean, this time, the same pronouncement was made. Jen Easterly came out the day after the election and said the elections were safe and secure and legitimate But of course, in this case, that benefits President Trump. And so, I guess what I'm wondering is to what degree is he going to hold on to old grudges or--?
Ben Yelin: To Donald Trump's old grudges?
Dave Bittner: Or will he take the good news from these organizations, and since it is to his benefit, they are his best friends now?
Ben Yelin: So one thing about Trump is you just have to see where-- how far the Trump tentacles expand because there are certain things he really cares about, right? Immigration is one of them.
Dave Bittner: Sure.
Ben Yelin: Trade is another. And then what he sees is the politicization of the Justice Department. So I think the early part of his administration is going to be focused on those three goals, which might mean incidentally that everything else benefits from kind of benign neglect. In one area, you've seen discussion about that is the Federal Reserve. I think there was some murmurs that he was going to try and fire Jay Powell, who he originally nominated to be the chair of the Federal Reserve Board.
Dave Bittner: Can he do that?
Ben Yelin: No, he cannot.
Dave Bittner: Okay. I didn't think so.
Ben Yelin: He can request that Powell resign. But they asked Powell about that and he's like, "No, I'm not, I'm not resigning."
Dave Bittner: Okay.
Ben Yelin: So I think, it's one of those things where if you can kind of stay away from his limelight, he might not focus on the agency and you can kind of keep the systems of government running while he's focusing on something else. I think we really actually saw that to a large degree during the first Trump administration, at least for most of it. I mean, CISA was actually quite well run before the post-2020 debacle. If you think about something like public health, they put a very competent person, Scott Gottlieb as head of the Food and Drug Administration, Operation Warp Speed was a stunning success. The head of the CDC, there was some criticism of him, but he was largely competent. But I think if it's an agency where Trump has some grievance or some score to settle or some promise that he's made to a key constituency, that's where I would be concerned. Besides the Russia thing, I don't think any of those topics, I don't think cybersecurity falls into any of those buckets, which might be favorable for those of us who just want to see a continuation of the successful policies of both Biden administration and the past Trump administration.
Dave Bittner: Yeah. And I think certainly Jen Easterly at CISA has overall received high marks for her leadership of that organization.
Ben Yelin: Totally, and bipartisan support, including from some unlikely sources among Republican lawmakers. So then the other big one I'd be looking out for is efforts on antitrust and monopolization, as it applies to big tech companies. So Lina Khan has been at the FTC. She has been a crusader against monopolies. She's engaged in trust-busting, filing these lawsuits. It's been controversial, Big Tech hates her. When there was still a possibility that Kamala Harris would win the election, I think Big Tech was trying to curry favor with her campaign and say, "Hey, we might help you a little bit, but Lina Kahn's got to go." Now Trump won and Lina Kahn has a very unlikely super fan. He is currently a United States Senator, but he's about to move into the Naval Observatory Center, and that is Vice President-elect JD Vance. I wonder if Vance can convince Trump to hold on to Lina Kahn and actually have some continuity in this effort to bust up these big tech companies. From President Trump's perspective, I think the way he thinks about it is twofold. For one, he still holds a grudge against Big Tech for what he thinks was election interference in 2020 specifically, how they dealt with that whole Hunter Biden laptop story. And then President Trump is now relying a lot on the advice of Elon Musk, who is going to be adamantly against these efforts to break up big tech companies because Musk owns one of them now.
Dave Bittner: Right.
Ben Yelin: And he's also friends with a lot of VC types in Silicon Valley who think that keeping Lina Kahn would be the end of the world and it seems like so far, at least Trump is listening to Musk and his recommendations.
Dave Bittner: Well, and also Musk a huge government contractor with SpaceX.
Ben Yelin: Oh, yeah. Oh, yeah. That's why Musk, I think, made such a significant effort to get Trump elected as there is a lot in it for him as somebody who has these big government contracts and somebody who doesn't want to see intense efforts at getting rid of monopolies in the tech industry. So I think Musk is going to be a key advisor. There's some reporting that he's been stationed in Mar-a-Lago and has had kind of veto power in a sense over the early nominations to the second Trump administration. He was really paramount in what was a successful "get out the vote" effort. He put a lot of his own money into it and it worked. So, I think, he might be trying to exert his influence and say, "Hey, I helped you get elected. You need to listen to me and my recommendations." And Trump promised Musk a role in supervising cuts to federal agencies.
Dave Bittner: Right, right.
Ben Yelin: Obviously, Musk--
Dave Bittner: I'm sorry. Musk famously said he wanted to cut $2 trillion from our $6 trillion budget, which is folly.
Ben Yelin: Yeah, if you want to get rid of things like the NIH and Federal Highway Administration, that would be a great way to do it. I am skeptical that Musk can put together a politically palatable list of $2 trillion worth of funding cuts. And I also think like in his heart of hearts, Trump doesn't really care that much about the federal budget. He's certainly not a budget hawk, he raised the deficit significantly in his first term. He is very interested in extending the Trump tax cuts, which I think will be a goal of his first year. And he made promises that I think really earned him some goodwill among a lot of voters not to touch entitlement programs like Social Security, Medicare, and Medicaid. And I think a lot of people would be angry if he went back on those promises. So he'd have to cut a lot of discretionary spending. And I don't know that he has the appetite or the wherewithal to actually see that through and make it happen. If it does happen, and if Elon Musk is able to identify $2 trillion worth of cuts, that's going to have massive downstream effects on cybersecurity. We work with a lot of state and local agencies who receive Homeland Security money for cybersecurity preparedness and response plans. That type of money might potentially dry out and that's just kind of the tip of the iceberg. So that's something that I would worry about. If I were to be an armchair psychologist here, I think Trump might get jealous that Musk is being seen as the puppet master and the brains behind the operation. And if I were a betting man, I'd say there's going to be a pretty messy divorce between the two of them, but that's just me.
Dave Bittner: Right, right. Both of them like to be the center of attention and there can only be one.
Ben Yelin: Yeah, I think there's going to be some moment when Trump says, "I'm the MF-ing president, and nobody elected you."
Dave Bittner: Right, right. Yeah, that's interesting.
Ben Yelin: And I think that might come sooner rather than later, so--
Dave Bittner: How about, you know, you were talking about privacy and communications and so on. How about the FCC? What do we think is in play there?
Ben Yelin: So, the FCC right now is under Democratic control. That would revert to Republican control under a Trump administration once he's able to submit his nominees and get them confirmed by a Republican Senate. And so, I think you'd see just kind of more of a typical Republican Federal Communications Commission, much more hesitant to promulgate regulations to levy fines on companies for violating privacy practices. I read an article about how the Biden administration's FCC has levied fines against big tech entities for selling data to data brokers. And there are legal challenges to these fines. The challenges are, to me, kind of mixed up and obscure legalese about whether these companies were entitled to civil jury trials and the exact meaning of the relevant statute. But if I were to predict, especially with Musk's influence, I think the FCC under Trump could just reverse those fines. And those fines just simply would not be levied because of the policy change of the administration. I think we could see a lot of those. If the Biden administration tries to effectuate last-minute regulatory changes, those face a very perilous path. There's something called the Congressional Review Act, which means that any regulation enacted by an administration, Congress can vote. It's a majority vote, not subject to the filibuster in both houses to overturn that regulation. Now, typically this doesn't work because Congress will pass that bill. It goes to the president. The president is the one who oversaw the enactment of that regulation in the first place. They're going to veto it, right? But with a new president, President Trump would not veto those bills that would overturn already enacted regulations. We saw that happen a lot in President Trump's first term. Obama tried to get "midnight regulations" passed on everything from data privacy to cyber security to environmental standards. And Trump and the Republican Congress at the time was able to overturn those through the Congressional Review Act. And then one other interesting wrinkle to all of this, we talked about the Chevron case over the summer.
Dave Bittner: Right.
Ben Yelin: And Chevron was a 1980s case that held that agencies were given deference in their interpretation of statutes in terms of formulating regulations. And that was overturned, which I think a lot of liberals were upset about because they were thinking this is going to inhibit our administration, the Biden administration from promulgating regulations to protect consumers. That decision to overturn Chevron might now confer benefits on people on the center-left because it could hamstring the Trump administration's ability to promulgate regulations of their own. Now, there's no guarantee of that. If you believe that the court, Supreme Court justices are just a bunch of partisans and robes, then maybe it doesn't matter. But I think that's certainly something to look out for.
Dave Bittner: Well, you mentioned the Supreme Court, looking forward over the next four years, any tea leaves to read there in terms of potential appointments on the horizon?
Ben Yelin: Yeah, so there are two conservative justices who are getting closer to retirement age. Clarence Thomas has been on the court since 1991. I'm sure he's going to want to travel the country in his RV.
Dave Bittner: In his RV.
Ben Yelin: This is the perfect opportunity for him to do so, you have a Republican president and a Republican Senate. Part of me thinks he might stick around because he wants to set records in terms of being one of the longest-serving justices. The other one I look out for is Justice Alito, who is probably the most conservative justice appointed by George W. Bush. He's been on the court almost 20 years now and he might see this as an opportunity to have somebody younger and justice conservative replace him. So the two of them are the ones I would look out for. President Trump has already gotten three Supreme Court justices confirmed. So if those two members retire and President Trump replaces them, then he would have appointed a majority of the United States Supreme Court.
Dave Bittner: Wow.
Ben Yelin: The thing that liberals should be very concerned about is the health over the next four years of the three liberal justices. None of them are particularly old, though Justice Sotomayor I believe just turned 70 and she is a type 1 diabetic and has had other health issues. So if what happened to Ruth Bader Ginsburg happens to Justice Sotomayor, then President Trump would have a chance to put a greater stamp on the Supreme Court. You'd have a seven to two conservative majority instead of the existing six to three conservative majority. So that could obviously be a major consequence that comes from this election.
Dave Bittner: Yeah, where do you suppose this puts us in terms of any hopes of federal privacy legislation?
Ben Yelin: That's a great question. I mean, I think because Trump is so mercurial and kind of deducing his policy views is very dependent on whom he talked to last or what's been making him angry, what he's seen on Fox News. Like it's hard to pinpoint him on any particular policy. I think-- I don't think this has a measurable impact on the odds of there being national data privacy legislation, just because I don't think he's weighed in on the topic one way or the other. I don't think he has ideological conservative views where he would say, let's leave this up to the states because I believe in federalism. But I also just don't think this is something that he's thought about.
Dave Bittner: Well, I mean, can we-- are we in agreement that the odds would have been low either way?
Ben Yelin: Yes, that we can be in absolute agreement.
Dave Bittner: And so there's no-- we don't expect to see any push from him to see something through.
Ben Yelin: I doubt it. I don't think that's going to-- it's not a priority of his.
Dave Bittner: Exactly. It's not going to bubble up to his priorities.
Ben Yelin: Exactly. And any president, Trump or anybody else, I mean, you have to focus on the two or three things you want to get done because time passes really quickly. Even with majorities in Congress, you only have so much political capital and you only have so much time. And the things you know he really cares about, trade, immigration, the politicization of the Justice Department, I think those are really going to be his areas of focus, and everything else might fall by the wayside. I did see that, as you know, TikTok by statute has been banned in this country if TikTok is not sold prior to January 19th, I believe it is, to a US entity. President Trump is trying to reverse that. I read a snippet of an article saying that he is trying to reverse that ban, which is a change in position for him. When he was president, he tried to ban TikTok and then he met with some investor who was like a TikTok booster and he changed his mind after that meeting.
Dave Bittner: Oh, interesting.
Ben Yelin: So, Biden will still be president when that date comes along, but President Trump might be able to finagle it so that ban is reversed, maybe by telling his Justice Department not to enforce it, which he can do. I mean, that would be prosecutorial discretion from the Justice Department, so that's another thing to look out for. One I almost forgot about, I'm glad you reminded me there.
Dave Bittner: What about the military? I mean, obviously, Donald Trump will once again be commander-in-chief here. It strikes me that with all of the opposition that he got from very, very high-up people in the military, well, I suppose mostly retired folks, but people who are in his own administration, but, you know, serious people--
Ben Yelin: Yeah, his former chairman of the Joint Chiefs of Staff, Mark Milley, being the foremost critic.
Dave Bittner: Right. Who, you know, have the sober responsibility of leading the defense of our nation and protecting our allies and all of that stuff? I guess, I'm trying to-- when you look at someone like Donald Trump, who certainly has the capability of being vindictive, I suppose has never had a great relationship with our military because of the things he said about soldiers. You know, I'm thinking of John McCain, you know, "I prefer heroes who weren't captured," and those sorts of things. But it's interesting because you get all of that, but at the same time, I think a lot of the folks who are in the military are certainly avid Trump supporters. That demographic of people are behind him.
Ben Yelin: I think that's totally true. I think his issues are with Pentagon leadership.
Dave Bittner: Right.
Ben Yelin: A lot of-- maybe not Trump himself, but his protégés, his boosters online, have been arguing ad nauseam over the past few years that the Pentagon is too woke. They're too focused on diversity, equity, and inclusion. They're not focused enough on destroying our enemies. I think Trump is going to try and put his ideological stamp on the Pentagon. We do not yet know who his Secretary of Defense will be, but I think it'll be somebody who's a very close political ally of his because his secretaries of defense in his first term turned against him. The first one was General Mattis. who he appointed, somebody who had an extremely distinguished career, bipartisan credentials. Mattis resigned and became a Trump critic. And then Mark Esper was his permanent replacement. He also turned into a Trump critic. I think this is an agency where Trump will try hard to put his ideological stamp on it. One person I'd look out for is former Democratic representative, Tulsi Gabbard, who was a military veteran. She endorsed President Trump, has kind of become a prominent person in the MAGA movement. And so I could see her being up for that nomination. I think she's somebody who has experience with defense policy and also has some ideological kinship these days with President Trump. So I think she's somebody that we can certainly see nominated if I were to prognosticate on that one.
Dave Bittner: Yeah. It's, you know, it's so interesting coming into this is because we-- you know, this is coming. This is the way it's going to be. And it's just, for me personally, and, you know, listeners of this show will not be surprised that I am not and have not been a Trump supporter. But just this idea that we're in for some more chaos, you know, I think it's fair to objectively say that the first Trump term was chaotic, and, you know, please hold on to the bar. Here we go again.
Ben Yelin: Yeah. I think the big question is how much of the promises that he made on the campaign trail is he really going to follow through on, how many of those promises he just made to get votes? Because I think it's kind of in his best interest not to follow through on some of those promises. Like 10% across-the-board tariffs would be bad for him politically because we import a lot of stuff that we just can't grow in this country, like say coffee or bananas. And having everybody pay 10% more for those products is going to be a political loser for him. And so, that might disincentivize him from actually following through with it. And I think that's true for a lot of things. I think in a way that makes him distinct from a lot of other Republican politicians is he does not want to alienate his base and he knows what his base really cares about. Certainly, immigration is one of the things they care about but also promises that he's made on entitlements. And he knows that he would be betraying his political base if he were to reverse himself on those promises and that it would hurt him politically. So I think the best case for Trump critics is that he just doesn't follow through with a lot of what he said on the campaign trail. That happened a lot in his first term. A lot of the things he said he was going to do, he just didn't do. But certainly, I think we can anticipate a lot of what we saw in his first term, which is chaos, changes in personnel, controversy. You know, it's season two of the Donald Trump show. He is an entertainer by nature. He likes to shake things up. He likes to be the center of attention. He is not interested in being a president who disappears into the background where we don't think about him or her for weeks at a time. He's going to want to stay the center of attention. To do that, he's going to have to take some actions that make news.
Dave Bittner: Right. He's Thomas Jefferson. He's not going to submit his State of the Union in writing.
Ben Yelin: No, that's not going to happen. That is his biggest show.
Dave Bittner: Right.
Ben Yelin: I will also say, we spent a lot of time over the past year talking about Joe Biden's age and certainly that age showed itself during the campaign, especially his disastrous presidential debate.
Dave Bittner: Yeah.
Ben Yelin: Trump is older than Biden was when he was elected. And he will be 82 years old at the end of his term. I'm not a doctor, but I also know that he doesn't live the healthiest lifestyle in the world. He doesn't believe in exercise. Most of his diet consists of fast food. So, I mean, it's just like something we have to think about as morbid as it might seem, and it also raises, I think, the scrutiny that's going to be on his vice president, JD Vance. JD Vance is much more well-spoken than Donald Trump. He does not have his charisma. He does not have the same type of pull with the Trump base, the same type of emotional connection, But I do think he is maybe a little bit ideologically committed to the cause of Trumpism than even Trump is. And so I think Vance might be more likely to walk the plank on an unpopular policy because he believes in it ideologically, whereas Trump has a very keen eye on what he thinks would make him unpopular. And he doesn't want to do anything that would make him unpopular.
Dave Bittner: Right. All right. Well, I feel like we just scratched the surface because there's so much.
Ben Yelin: And I'm sure we'll be talking about it more as the transition continues, and as we get into Trump 2.0.
Dave Bittner: Yeah. Well, as they say, time will tell, and these are for sure going to be interesting times. So, away we go. [ Music ] Ben, I recently had the pleasure of speaking with Sarah Hutchins. She is a partner at Parker Poe, and we're discussing the growing number of state data privacy laws, some litigation trends that she's been tracking when it comes to targeted advertising and wiretapping. Sarah is a litigator. And some key takeaways for companies on cybersecurity practices and risk reporting. Here's my conversation with Sarah Hutchins.
Sarah Hutchins: Well, first off, thank you so much for having me, but I hate to disappoint, but I don't think you can call it level at all. We are not level-setting. We-- and I think the clients that I represent, companies all over the country, are dealing with an environment that I would say is really in flux. There are some federal guidance that's available to, especially certain industries or focused on certain categories of people, but in large part, we're dependent upon the states to give us regulatory guidance at least as to what is or is not okay with respect to individual data. And the challenge with that for a lot of companies is that while they may be in a certain state, their sort of digital presence is non-jurisdictional. They're all over. And the laws are, at the state level, are largely focused on where the individual lives. So companies find themselves subject to a whole host of different laws. Some, I would say, comprehensive, like California, for example, and some that are maybe niche specific to them because they're in a certain industry or collecting on a certain type of person. And they have to balance that with all of the other types of laws that they are subject to in other states and at the federal level.
Dave Bittner: I'm curious. Have you found there to be any situations where there are laws that are contradictory?
Sarah Hutchins: Oh, absolutely. Now, some of the state laws that we're seeing, and I would say we've got, at this point, late October 2024, we've got about 19 state laws that have been enacted that I would sort of label as comprehensive. And there is some degree of guidance for each of these laws, although in some instances it's promised in future rulemaking, as to preemption with other existing statutes, largely federal statutes. So, for example, financial data or data that's collected by an entity when they're offering credit to a consumer. In some instances, state laws will say that there's an entity-level exception. So if you're subject to the Gramm-Leach-Bliley Act because you're a financial institution, if it's an entity-level exemption, then your entire entity is forgiven essentially from complying with the state law. But sometimes it's only a data-specific exemption, and that would just be the certain data that you collect that's subject to that federal law is subject to one law, and then the rest of the data you have is subject to state laws relative to that specific person. And other times it's not specified yet, and you sort of have to try to comply with both, and they may, to your point, be in conflict. Another example would be employment information. There are lots of laws at the state and federal level that require long-term retention of certain types of employee documents and information. But other laws that are directing you to adhere to really strict data hygiene, data minimization regimen. And those can also send conflict messages to companies as well.
Dave Bittner: Are there differences between the states in terms of how aggressive they are in pursuing these things?
Sarah Hutchins: Yeah, absolutely. And I think we saw that too at the state data breach laws. There's all 50 states have a data breach law that's going to dictate certain steps that company needs to go through and certain ways that they need to hold some of their data. And you would see certain attorney generals be much more aggressive than other states when something like that happens to their constituents if they're subject to a breach. We're seeing the same thing with the focus that some states have on the laws that they are enacting. And some are going so far-- we've got at least three that have created privacy offices, so to speak, that are solely focused and get additional resources to pursue adherence to their comprehensive data security, data privacy statutes. And that's important, especially for consumers because the vast majority of these statutes do not have a private right of action. So the way that you get companies to adhere to it is through enforcement by the Attorney General's Office and not necessarily through civil litigation.
Dave Bittner: How are you and your colleagues recommending that folks approach this patchwork of regulations here? I mean, how do you take a practical approach to this?
Sarah Hutchins: It's certainly difficult. And I think It's very important to have that be a continuous and constant element of a company's hygiene and governance process. It's not sort of a one-and-done. I think maybe the old adage is true that an ounce of prevention is worth a pound of cure. Unfortunately, a lot of clients, because I'm a litigator, come to me with a renewed focus on compliance, sort of post-litigation, post-learning rather expensive and difficult lesson. But if you can highlight compliance, and it's especially important, I think, for companies this time of year because it's usually budget season for the next year, you can hopefully make yourself unattractive to a regulator or unattractive to a plaintiff's attorney for different types of statutes that do have a private right of action related to data to avoid that kind of litigation headache and frankly financial loss. So working on really making sure all of your stakeholders are at the table. It's not enough to have the legal department or frankly your outside attorney like me come in and draft a bunch of policies and procedures if they don't align with your actual practices. So making sure that marketing is at the table and HR and certainly your IT department, your information security professionals and make it a holistic process. What kind of data do we have? How do we get it? What do we use if for and how do we dispose of it and share it, if we do? And with those policies and procedures, you can put into place the right processes, the right consents, and the right disclosures that really make your sort of outward-facing appearance show that you are in line with this myriad of statutes. But also internally, you will have processes in place to deal with the data that you have, to put in place appropriate hygiene, and in the event an incident occurs, you know what data you have and how you're going to respond.
Dave Bittner: For those of you who are at this every day, you know, what's the hope of there being federal legislation here? You see, well, having your, you know, your water cooler conversations. Is there-- is it in any sort of realistic horizon?
Sarah Hutchins: Well, I assumed-- we're right on the cusp of Halloween so I assumed you brought me on as a litigator for your, you know, Fright Week or Data Privacy Scary story session. I'm not hopeful. I think obviously the upcoming election can shed a lot of light, I guess, as to who will be in charge. But there's some fundamental differences at the federal level between what the two leading parties want. There's disagreements really as to that private right of action that we talked about, if there is going to be a federal statute, and also on preemption. Some of the states that have more mature processes like California would want their enhanced security and privacy measures for their constituents to stay in place and that is at odds with at least one political party's belief. So I am not hopeful. I think that we are going to continue to rely on states for guidance and to push the industry through this patchwork of laws to more and more attention on consumer privacy rights.
Dave Bittner: Before I let you go, I want to tap into your expertise here as a litigator and ask what you're seeing when it comes to litigation for things like targeted advertising. Where are we here?
Sarah Hutchins: It's been a real interesting year, especially post-pandemic we've seen an uptick in all sorts of data privacy, data security-related litigation. I think we're always going to see litigation related to data breach. I heard a statistic, it sounds about right in my experience that one in five security breaches will result in a class action and those can be really, really expensive. But what we are seeing that's sort of outside of the typical where there's been some sort of bad actor and leakage of data, we are seeing old statutes be sort of repurposed for the digital world that we're living in. A lot of these statutes, like the California Invasion of Privacy Act and other states have similar ones, govern individuals' interactions with each other and recordings of each other through telephone calls, so eavesdropping statutes, wiretapping statutes. And many states are single-party consent, needing only one person, usually the actual caller, to consent to recording. But there are a number that are two-party consent. And I would say--
Dave Bittner: I live in one of them.
Sarah Hutchins: Right.
Dave Bittner: I'm in Maryland, yeah, yeah.
Sarah Hutchins: Yeah. And, you know, entrepreneurial plaintiff's attorneys in recent years have looked at those statutes and applied them essentially to the internet age that we're living in. And companies that are using certain tools on their websites like session replay and pixels, chatbots, other interactive tools, some of which to make sure that their website's operating appropriately, security measures, some is for targeted advertising, as you said. But they more often than not are communicating and providing data to a third party. A lot of these, essentially, storefronts that have a website are not in the business of collecting data in that way. They just want the results, the guidance, essentially, for how they should be marketing their products. But that may potentially be involving another party to a conversation where there is not consent. And so we're seeing sort of what's old is new, taking these statutes and trying them in different ways to see if there's a violation of law. And a number of these statutes are very attractive as far as a class action because they have statutory damages. And so if you can find a violation or simply threaten one on a company that may or may not actually run their business in a way that sells directly to consumers, that they do have a website that collects information. Plaintiffs' attorneys are finding some degree of success, both in court, but also more likely in out-of-court settlements in pushing the idea that these are violative of these invasion of privacy statutes that exist in a number of states.
Dave Bittner: Wow. So, I mean, given all of that, what are your recommendations for folks who are responsible for the cybersecurity at their organizations?
Sarah Hutchins: Again, it's that preventative measure to make yourself unattractive, make your website show all of your activity, have the appropriate disclosures. And that starts at having all of the stakeholders at the table. So if your marketing team is putting pixels and other things on your website without, let's say, legal oversight or information security oversight, that process may need to be improved. You want to have policies and procedures in place to identify the pixels and other products that are on a website. A lot of times I find my clients don't even know what's there. And going through a cookie compliance process to see what's on the website can sometimes be really expensive. So knowing what's on your website and knowing what it's used for, there are a lot of products that may not provide the value, but also provide a lot of risk. And so if you have a product on your website that's collecting information, making sure that that information is needed, and if it is, having the right disclosures, in some instances consents to collection and use of that information is all key. [ Music ]
Dave Bittner: Ben, what do you think?
Ben Yelin: It's a really interesting interview. It was a great interview. It's a perspective we don't get very often. I am a lawyer, but not a litigator. So it's always interesting to hear from litigators who are actually in the trenches and are intimately involved in these cases, especially as we work through this patchwork of laws related to data privacy. So really an excellent interview.
Dave Bittner: Yeah, I really enjoyed the conversation and I hope Sarah will come back sometime. I feel like it was really informative and time well spent. So again, our thanks to Sarah Hutchins. Again, she is a partner at Parker Poe. We appreciate her taking the time for us. [ Music ] And that is "Caveat," brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes, or send an email to caveat@n2k.com. We're privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams while making your teams smarter. Learn how at n2k.com. This episode was produced by Liz Stokes. Our Executive Producer is Jennifer Iben. The show is mixed by Tré Hester. Our Executive Editor is Brandon Karpf. Peter Kilpe is our publisher. I'm Dave Bittner.
Ben Yelin: And I'm Ben Yelin.
Dave Bittner: Thanks for listening. [ Music ]
