The SECURE Data Privacy Bill Is Worth Reading, Even If It Dies
The SECURE Data Privacy Bill Is Worth Reading, Even If It Dies
Publish Date: 2026-05-22 04:29:00
Source Domain: news.bloomberglaw.com
Federal privacy legislation has spent a decade stuck in the same loop: A bill drops, a hearing happens, the draft stalls, and companies go back to stitching compliance programs across the patchwork of state laws. What we’re left with is a quilt stitched by 20 different hands with no two squares quite lining up.
Into that frayed picture comes the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act, or SECURE Data Act, introduced last month by Rep. John Joyce (R-Pa.). It may follow the same script as the bills before it, but the operational reality has already shifted in a direction that rewards preparation over patience.
The question is no longer whether a federal privacy law will emerge, but when and in what form. Privacy programs were once designed to respond to individual laws; increasingly, they have to be built to withstand change. Companies that prepare for a federal framework will be ready when Congress finally is. The ones that wait will be the ones rebuilding under deadline.
A patchwork approaching its limits. The strain of the current system is no secret. Each new state law arrives with its own definitions, consumer rights, and enforcement mechanisms, and privacy teams have spent years reconciling them. The whole exercise rests on a bet that fragmentation will continue.
The SECURE Data Act breaks the assumption with its strong preemption language, which would moot any state law that “relates to” its requirements, combined with a one-to-two-year effective date, means organizations will need to revisit privacy programs they have spent five years assembling.
Additionally, the bill draws largely from the Washington-state model that Virginia adopted and Kentucky refined, preserving baseline rights to access, correct, delete, and port personal data and to opt out of sales, targeted advertising, and consequential profiling. Programs heavily indexed to obligations specific to California, Colorado, or Texas will need a hard second…
