Gretchen Herault is senior privacy counsel at GE Healthcare, responsible for data privacy issues in the U.S. and Canada. The company is subject to the Health Insurance Portability and Accountability Act, known as HIPAA; the European Union’s General Data Protection Regulation, or GDPR; and will be subject to the California Consumer Privacy Act, or CCPA, when it goes into effect in January 2020.

Herault spoke to Corporate Counsel about the possibility of federal privacy legislation and the benefits to early adoption of privacy laws. This conversation has been edited for length and clarity.