Emerging Market Experts Share Tips on How to Navigate Regulatory Shifts

Keeping up with the ever-evolving regulatory landscape is a challenge for even the most established industries, but for emerging markets, it’s often uncharted territory. And with mounting pressure for stronger regulations, 2022 is going to be crucial for organizations still establishing their place in the economy.

FiscalNote held a virtual discussion on key regulatory changes emerging markets will face in 2022, featuring industry professionals in cannabis, cybersecurity, the gig economy, and autonomous vehicles. Joining the conversation were Jonathan Miller, general counsel at the U.S. Hemp Roundtable; Joshua Wilkenfeld, director of delivery and emerging technologies, regulatory at Uber; Drew Bagley, vice president and counsel of privacy and cyber policy at CrowdStrike; and Finch Fulton, vice president of policy and strategy at Locomation. These experts discussed the regulatory challenges they’ve encountered and are expecting in the future, how to manage them, as well as their predictions for the coming year. Here are the highlights from the discussion:

What are the biggest regulatory changes and trends we'll see in 2022?

Miller: This has been a fascinating process in that we are one of the few industries that is demanding that the federal government regulate us. Generally, industries are urging the government to stay out. But we have a unique situation here where the FDA has argued that it is illegal to sell CBD as an ingestible product.

So, we have really been demanding that the FDA take action. Unfortunately, although they've been promising a pathway, just in the last couple of weeks, the acting commissioner has said, "Well, our hands are tied. We're in a legal stalemate. We can't act now." We disagree with that, but what's clear is that Congress needs to act.

So it's really incumbent that the federal government acts. We will be making that the highest priority of our organization and our industry in the weeks ahead.

Wilkenfeld: We face a patchwork of rules that are not only complicated and cumbersome but also, in certain situations, incoherent and not really useful to meet the policy demands. One of the nice things about our delivery business is that we are engaged in a lot of business-to-business connectivity and the core constituency for us is the merchant community. And merchants, whether big or small, are sophisticated commercial actors. They know what's best for their business, typically more than the regulatory community will.

We've seen some emergency restrictions that have grown out of COVID-19 to protect the merchant community, and sometimes for other very valid reasons as well. But I think as we're moving out of that, we feel relationships are better governed through bilateral negotiations, which is not to say there isn't an important role for regulatory development in this area.

Alcohol delivery is, for understandable reasons, more complex than restaurant delivery. And you see different efforts to try to graft folks like Uber and other new entrants into preexisting regulatory categories. Most merchants who sell alcohol have a license from a state or local board, but what do you do with folks like us? You could treat us like an agent of the licensed entity and have us exist as an outgrowth of the licensee's authority, you could try to craft a new categorization, or you could treat us like a trucking company. Often, none of those work super well. Of course, there are understandable policy imperatives if you're delivering alcohol or prescription drugs that are different from if you're delivering sliders or burritos. I do think we're seeing some movement in that area.  

Bagley: We've actually had a few state privacy laws go into effect in the past two years, where you had the California Consumer Privacy Act (CCPA), now going to be replaced by [the California Privacy Rights Act of 2020 (CRPA). We have Virginia's privacy law and Colorado's, and then Connecticut has a new cybersecurity law.

When you look at CCPA and what was built upon with CPRA, you actually see that now, there is a recognition that cybersecurity is part of privacy. Organizations holding data are now required to implement reasonable safeguards, and that's really reflecting what we've seen globally and what we've seen U.S. organizations embracing because of General Data Protection Regulation

(GDPR). GDPR, for example, requires organizations to embrace safeguards that are appropriate to the risk while paying attention to the state of the art.

Seeing that now trickle into the U.S., what you're really seeing is, "OK, the cybersecurity threat is not only not going away, it's actually evolving, and we need to take this principles-based approach whereby organizations have to protect data in something that's going to evolve." I think that that's actually been a positive development from a regulatory standpoint.

Fulton: You'll see different things happening in Congress and at the USDOT. Ultimately, industry doesn't need Congress to act. The USDOT has the authority it needs to move forward the regulations. They have specified what those regulations are. Congress can tell them and put timelines on those regulations and say, "You will do this within two years." But the USDOT has what it needs.

We have people leading our convoy with the automated trucks following, and there are times where we will be able to deploy where our competitors can't. And the reason is while the vehicle can be driven by a human or a machine and still be legal, there's other requirements of a commercial driver beyond just driving the vehicle, things like inspection requirements, dealing with law enforcement, maintenance, or an unexpected repair if there's a tire blown on the road. Even some things that aren't requirements like dealing with customers, dealing with first responders, dealing with unplanned-for situations. Until that rule-making goes forward, no autonomous trucking company will have a way to pull the driver out of the vehicle. That's going to take years.

How do you think about the “soft law” aspect of your work in an emerging market?

Wilkenfeld: Like Spider-Man's uncle says, "With great power comes great responsibility," right? We don't have great power, but maybe we have great responsibility. Certainly our presence and track record is helpful in certain respects, getting audiences with folks may give credibility to what we're saying.

I think it also comes with a higher standard of review for what we want to do, both in terms of partnering with public-sector and working honestly and transparently. Whatever the backdrop is for the message, you can lose that credibility in a cold instant.

I do think that that's the needle that we're trying to thread here — moving with alacrity into new areas. There's lots of exciting opportunities, both in terms of new markets that may face no regulatory challenges but come with reputational risks or require a stretch of our resources, and those where the regulatory questions are more interesting. Striking that balance is often a day-to-day exercise.

How can we address regulatory inconsistencies for emerging markets and create a more efficient system?

Fulton: I think step one is making sure that you eliminate as many uncertainties in the market as possible. At USDOT, we had, I think, four guidance documents we put out that provided more clarity on how the government was addressing these issues. The role of federal, state, and local government; the role of research and how it was going to shape these future policy efforts; and how those would shape future regulations.

So really trying to break and to lower the barrier for understanding of what they need to do and what are the avenues to do it. I think that should be a responsibility of the federal government and all levels of government if you're going to have an innovative ecosystem like you have in the U.S. 

Once we have such a standard, is that actually solving problems, or does it create more challenges?

Bagley: For us, during the journey from startup to a large public company, it was really helpful to have some sort of standard to rally behind. That was the common denominator that all of our customers were coming to us to ensure we had compliance with.

That's why we were very proactive about that when we saw that coming down the pike. If you look at GDPR, I think the principles are great for even a startup today that's dealing with data to really rally behind.

That's something where it's important for regulators to understand that you can't conflate things like data localization with data protection, especially when the law itself doesn't call for data localization. I think any startup paying attention today, you might not be able to do the 50-state survey, but think about what are most of your future clients, customers, and stakeholders really going to have to worry about, and how are you addressing that problem for them.

Miller: At the hemp industry we have set up our own self-regulatory structure, it's called the US Hemp Authority, where we've set standards that actually go above and beyond what the FDA would require. This is very common in the agricultural world, but having that SRO does not replace outside regulators. It does help provide credibility and maturity for a new industry like ours.

Tracking Legislation in Emerging Markets 

In a constantly evolving regulatory landscape, you can’t afford to miss a beat. Tracking legislation with FiscalNote greatly enhances your capabilities to stay on top of multiple bills and regulations across the states in a highly customizable platform, allowing you to search by keywords, focusing on exactly what you want to see, and providing that information in email updates right to your inbox.