Via E-Mail to privacyframework@nist.gov

Attn: NIST Privacy RFI 

Docket No. 181101997-8997-01 

Katie MacFarland

National Institute of Standards and Technology

100 Bureau Drive, Stop 2000 

Gaithersburg, MD 20899I 

RE: Comments of the National Association of Regulatory Utility Commissioners 

on the National Institute of Standards and Technology (NIST) November 14, 

2018 Developing a Privacy Framework, Request for Information, Docket No. 

181101997-8997-01. 

Ms. MacFarland, 

The National Association of Regulatory Utility Commissioners (NARUC), respectfully 

submits this brief comment on the NIST Developing a Privacy Framework request for information 

(RFI).

1

 NARUC commends the NIST for its RFI, seeking public comments on the creation of a

“voluntary” privacy framework to “improve organizations' management of processes for 

incorporating privacy protections into products and services.”2

Given NIST’s prominence, this RFI, although focused on voluntary standards, is likely to 

be grist for federal and state policymakers addressing privacy issues. It is certain the NIST 

framework will be cited as precedent for and will impact the evolution of mandatory privacy 

protections in all sectors 

Indeed, the RFI includes several “Organizational Considerations” (OC) that arguably 

implicate the impact of more stringent standards and multiple enforcement regimes. In particular, 

OC-11 asks how current regulatory or regulatory reporting requirements (e.g., local, state, national, 

1 U.S. Department of Commerce, the National Institute of Standards and Technology 

(NIST), Developing a Privacy Framework, Request for Information (rel. Nov. 14, 2018), Docket 

No. 181101997-8997-01, Document Number: 2018-24714, 83 Federal Register 56824, available 

online at: https://www.federalregister.gov/documents/2018/11/14/2018-24714/developing-aprivacy-framework#footnote-1-p56824. 

2 Id. 
 

 

 

 

 

 

 

international) relate to the use of standards, models, methodologies, tools, guidelines and best 

practices and principles. And in OC-12, the RFI asks about “mandates to use specific standards 

....and conflicts between requirements and desired practices.” 

Companies charged with complying with existing “local, state, national, international” 

regulatory requirements will likely use their responses to OC-11 and 12 to support elimination of 

competing privacy mandates and enforcement capability. 

NARUC respectfully requests that any final voluntary NIST framework specify it should 

not be used as a template to limit States’ options for enforcement of federal protections, or stronger 

protections promulgated through State law.3

It simply makes no sense to limit the number of State cops on the privacy beat or reduce 

(or limit) privacy protections currently available to U.S. consumers. There is no possible rationale 

to justify eliminating State enforcement of federal standards – effectively significantly reducing 

the number of privacy cops on the beat - other than to provide incentives for non-compliance and 

less protection to U.S. consumers. For the same reason, no federal action, including compliance

with voluntary NIST guidelines, should constrain State procedural options for enforcement. The 

only reason to limit a State’s enforcement options – the State agency, procedure/process, fine or 

penalty or State adjudicatory body effecting the fine or penalty - again is to limit enforcement, 

limit incentives for compliance with the standards, and require States to expend scarce resources 

to change existing procedures. 

Thank you for the opportunity to comment. 

 Respectfully submitted, 

James Bradford Ramsay

NARUC General Counsel 

 Federal customer data privacy standards should always represent “a floor not a ceiling— 

for the protection of consumer privacy.” National Association of Regulatory Utility 

Commissioners, NARUC Federalism Task Force Report: Cooperative Federalism and Telecom In 

the 21st Century, Nov. 2013, p. 10, online at https://pubs.naruc.org/pub.cfm?id=0D53064E-9E9C0929-9D01-FDBF631704F5 (emphasis added). 

3