Geopolitical Polarization Is Upending Privacy Regulation, IAPP Told

President Donald Trump is driving a lot of the privacy and data protection debate, said Cooley privacy lawyer Travis LeBlanc. The president slashed regulations and instead of keeping them within U.S. borders, he exported them, said LeBlanc, who noted that whether he's still on the Privacy and Civil Liberties Oversight Board (PCLOB) remains to be determined. Trump fired him and another PCLOB Democrat, Ed Felten, earlier this year, but those actions continue to be argued in court (see 2507010059).

LeBlanc also said Vice President JD Vance has attacked what he sees as European overregulation, a move that sparked a massive amount of debate in Europe. Some might credit that spark for the European Commission's digital omnibus package that was published Wednesday, he added (see Ref:2511190005]). Two other major forces at work in the privacy sphere are Russia and China, he added, and that's also changing how people think about data protection.

It's all about the race for AI, said eBay Chief Privacy Officer Anna Zeiter, with the need for high-quality data driving privacy laws. Countries now have more geopolitical interests in localizing data within their borders, she said.

It's easy for data protection lawyers and authorities to operate in a silo and ignore the impact that their decisions have globally, LeBlanc said. DPAs must realize they're making international policy when they choose to impose huge fines on U.S. companies, leading the administration to view itself as standing up for American business, he argued.

Ustaran said the challenge for DPAs as regulators is that they must enforce the law, and when they see an antagonistic level of pressure applied by another country, that leads to polarization. "Everyone goes to extremes." He pointed to another trend, data sovereignty, where data is deemed a strategic asset. That's leading to a sort of Cold War, he said.

With a real war taking place in Europe, EU countries don't have the luxury of creating more friction than necessary with a friend like the U.S., said LeBlanc, apparently referring to Russia's war with Ukraine. The main issue now is how data is becoming a national security issue, he said, not just in the EU but also in the U.S., where DOJ's rule on bulk data transfers is imposing a massive compliance obligation on American companies (see 2506240056).

One practical effect of the global situation is that data and geopolitics are increasingly part of companies' discussions, said Zeiter. Organizations must decide where to host data and where they can transfer it, she added, so data governance is key.

Another practical effect is increased liability for company executives for data violations, LeBlanc said. Yet another is the national securitization of data protection, involving national security officials who have no connection to privacy, he said. The PCLOB oversees the intelligence community, and the way it approaches data protection is not from the privacy perspective, he noted.

LeBlanc also pointed to the problem of whether companies can rely on advice from data protection officials from one year to the next, especially in the U.S., noting the FTC firings (see 2503190049) and the issue of DPAs' independence.

Despite all this, there's a role for responsible digital practices, including privacy compliance and AI governance, panelists said. It's about trust for companies, Zeiter argued.

The legal framework is a mandatory floor, added LeBlanc: "You can always go higher."