1. "Just follow NIST. The standards already exist."
The objection. NIST SP 800-63-4 already recognizes selective disclosure, privacy-enhancing technology and Zero Trust. What is needed is adoption and funding, not new statutory obligations.
What it gets right. The technical standards exist, and VIDA is designed to require the strongest architecture NIST recognizes.
The answer. NIST can specify how to build a privacy-preserving system. It cannot require anyone to build one, impose duties on the officials who use it, give citizens standing to sue, or prohibit the architecture of surveillance. A NIST-compliant system can still be constitutionally deficient, because NIST governs handling within an assumed architecture and cannot cure the architecture itself. The Privacy Act's purpose limits show what happens without enforceable structure: the "routine use" exception, defined by agencies themselves, has hollowed them out. The relationship to NIST is successive, not competitive.
2. "Data should be property. Let citizens own it."
The objection. Property is the most robust protection the law offers. Justice Gorsuch's Carpenter dissent argued for a property-based approach to digital privacy.
What it gets right. Individuals have a constitutionally cognizable interest in records about them. The framework agrees on the destination.
The answer. Property fails at three points. Facts are discovered, not authored, so they cannot be owned without legal fiction. Property can be alienated, so a property regime lets people sign protection away under structural coercion. And property cannot reach government's own databases, because collection authorized by law is neither a voluntary transfer nor a trespass. Trusteeship generates enforceable, inalienable duties without pretending facts can be owned. More on the commons.
3. "Feist is a copyright case. It does not reach the Fourth Amendment."
The objection. Feist held only that facts cannot be copyrighted. Extending it further goes beyond the holding.
What it gets right. The correction is accurate. Feist is a copyright holding.
The answer. The commons premise does not depend on Feist as precedent. It rests on the nature of facts: they have no author, no physical body and no owner in any established legal category. Treating facts as governable but unownable also avoids two bad outcomes: informational monopolies bought by the powerful, and individuals suppressing truthful information that others legitimately need.
4. "This will paralyze law enforcement and fraud prevention."
The objection. A kidnapping investigation cannot wait for separate warrants for phone, toll, plate and financial records. Fraud prevention requires checking applications against existing records.
What it gets right. The operational needs are real, and a framework that ignores them will not be adopted.
The answer. The acts do not prohibit access. They require that access meet existing constitutional standards and that systems enforce them, with bounded emergency authority for exigent cases. VLPFA delivers every warrant alert while retaining nothing about non-matching plates. Fraud checks run through query-without-collection: the system confirms eligibility or uniqueness without copying the underlying data. The verification happens; the surveillance capability does not. See the six hard cases.
5. "State action creates a patchwork, and federal law will preempt it."
The objection. Inconsistent state frameworks impose costs and may be preempted.
What it gets right. Patchwork is a real cost, and Congress can preempt some state privacy law.
The answer. The acts govern each state's own agencies, on constitutional authority, which is the hardest ground for preemption to reach. The federal impasse is structural, so waiting is a choice not to act. And uniform model language, not federal imposition, is how consistency spreads; Utah's SEDI program is already playing that role for identity.
6. "The costs are prohibitive and legacy systems cannot be retrofitted."
The objection. Budgets are tight, and integrated systems took decades to build.
What it gets right. Legacy transitions are hard, slow and expensive. That cannot be dismissed.
The answer. States already rebuild these systems on regular cycles. The acts require that rebuilt systems meet the new specifications, and PDTA Section 28 gives existing systems a structured transition: inventories, remediation plans with milestones, and a limited legacy safe harbor that delays structural remediation without legalizing unauthorized acts. Building the right architecture costs less than building the wrong one and paying to fix it. Sequestered systems also limit the damage of any single breach. See the implementation note.
Further objections, or a stronger version of these? Write to us. Answering the best criticism is how the framework improves.