Just four months into the General Data Protection Regulation (GDPR), thejury is in: Europe has seized a first-mover advantage and set theterms of the global privacy debate. Whatever its virtues or flaws,the GDPR is now the de facto global standard that othercountries' privacy regimes are measured against, and countriesaround the world are adapting their own laws accordingly.

As the United States begins a meaningful dialogue about anational privacy law, the GDPR will likely dominate theconversation once again. Ensuring rough equivalency (or, in GDPRparlance, “adequacy”) with data protection standards in theEuropean Union (EU)—and protecting lucrative cross-border dataflows—will be a critical function of any U.S. data privacy law. Atthe same time, the process of crafting a comprehensive law presentsU.S. lawmakers with the opportunity to recapture a globalleadership role on privacy norms and to promote a template thatwill reduce barriers to international business.