US Congress close to agreeing on a Federal Data protection Act
June 5, 2022 |
The USA stands alone amongst first world countries that does not have Federal Legislation regulating the collection and use of the personal information. That may soon change. The draft American Data Privacy and Protection Act was released by both House and Senate leaders on 3 June 2022. it is a bipartisan discussion draft data privacy bill.
The Act is an advance on many previous efforts because it has bipartisan support and incorporates compromise positions on state law preemption and enforcement.
The statement from the US Sentate Committee on Commerce, Science and Transportation provides:
WASHINGTON – U.S. Senator Roger Wicker, R-Miss., Ranking Member of the Senate Committee on Commerce, Science, and Transportation, and U.S. Representatives Frank Pallone, Jr. D-N.J., and Cathy McMorris Rodgers, R-Wash., Chairman and Ranking Member of the House Committee on Energy and Commerce, today released a discussion draft of a comprehensive national data privacy and data security framework. The draft legislation is the first comprehensive privacy proposal to gain bipartisan, bicameral support.
“This bipartisan and bicameral effort to produce a comprehensive data privacy framework has been years in the making, and the release of this discussion draft represents a critical milestone,” Wicker, Pallone, and Rodgers said. “In the coming weeks, we will be working with our colleagues on both sides of the aisle to build support and finalize this standard to give Americans more control over their personal data. We welcome and encourage all of our colleagues to join us in this effort to enable meaningful privacy protections for Americans and provide businesses with operational certainty. This landmark agreement represents the sum of years of good faith efforts by us, other Members, and numerous stakeholders as we work together to provide American consumers with comprehensive data privacy protections.
“This bill strikes a meaningful balance on issues that are critical to moving comprehensive data privacy legislation through Congress, including the development of a uniform, national data privacy framework, the creation of a robust set of consumers’ data privacy rights, and appropriate enforcement mechanisms. We believe strongly that this standard represents the best opportunity to pass a federal data privacy law in decades, and we look forward to continuing to work together to get this bill finalized and signed into law soon,” Wicker, Pallone, and Rodgers concluded.
The three committee leaders also thank House E&C Consumer Protection and Commerce Subcommittee Chair Jan Schakowsky, D-IL, and Ranking Member Gus Bilirakis, R-FL, and numerous members of the Senate Commerce Committee for their input and leadership on this discussion draft.
The American Data Privacy and Protection Act would:
-
- Establish a strong national framework to protect consumer data privacy and security;
- Grant broad protections for Americans against the discriminatory use of their data;
- Require covered entities to minimize on the front end, individuals’ data they need to collect, process, and transfer so that the use of consumer data is limited to what is reasonably necessary, proportionate, and limited for specific products and services;
- Require covered entities to comply with loyalty duties with respect to specific practices while ensuring consumers don’t have to pay for privacy;
- Require covered entities to allow consumers to turn off targeted advertisements;
- Provide enhanced data protections for children and minors, including what they might agree to with or without parental approval;
- Establish regulatory parity across the internet ecosystem; and
- Promote innovation and preserve the opportunity for start-ups and small businesses to grow and compete.
The story has been well covered by Husch Blackwell in Bipartisan U.S. Federal Privacy Bill Circulated and the Washington Post.
The Washington Post article provides:
Still, consumer rights advocates say, the proposed compromise legislation is the biggest breakthrough to date for efforts to pass a federal privacy law. Those efforts have been bogged down amid partisan disagreements. For years, Democrats and Republicans have remained at odds over what extent a federal privacy law should override state measures, such as the landmark California Consumer Privacy Act, and whether it should give consumers the right to bring their own lawsuits against violators.
Republicans support federal preemption of state privacy laws, fearing a patchwork of standards will make compliance difficult for businesses, while Democrats have sought a broad private right of action to give consumers legal tools if government enforcement fails. The legislation unveiled Friday seeks to strike a compromise, including a limit on when and how users can sue Internet companies and measures that would supersede most state digital privacy laws. Politico first reported news of the deal.
The bill would require companies to minimize their data collection practices to only what is necessary for the function of their business. It would also prevent organizations from charging users to access data privacy measures, except for narrow circumstances such as consumer loyalty programs or collecting financial data to complete a transaction.
The Federal Trade Commission would be required to maintain a public registry of data brokers and create a mechanism for users to opt out of targeted advertisements and other data sharing practices. Under the legislation, users would have the right to access, correct and delete their digital data, and companies would be responsible for informing third parties to make changes to the data of users who so choose. Corporate executives would be required to certify annually that their organizations are in compliance with the law.
To enforce the new requirements, the FTC would create a new bureau to protect consumer data privacy, and federal regulators and state attorneys general would be empowered to sue groups thought to be in violation of the law for punitive damages.
Individuals could also sue companies but only after a four-year waiting period from when the legislation is enacted. They are required to notify state and federal officials before pursuing a lawsuit, and they could not pursue the legal action if a government prosecutor takes up their case. The bill would also supersede most state data privacy laws, except for specific statutes on civil rights, student and employee privacy, criminal codes, and financial and health records.
“This draft shows that there is a bipartisan path forward on long-overdue legislation to protect consumer privacy,” said Alexandra Reeve Givens, president and chief executive of the Center for Democracy and Technology, a nonprofit research group that receives funding from companies such as Apple and Google. “Americans want and desperately need legislation to protect their personal data and promote trust in the online world. While it’s not perfect, the draft is a hopeful first step.
Internet trade association TechNet said the proposal “shows the engines are revving on this issue in a way they haven’t in a long time.” While the legislation “still needs further improvements, it’s an indication that leaders from both parties are committed to action and willing to compromise on key issues like a private right of action and preemption,” Carl Holshouser, senior vice president of the group, said in a statement. “Additional negotiation is needed but we’re more hopeful than we have been in years that a bipartisan privacy bill can make its way to the president’s desk this Congress.”
But major obstacles remain to get a deal signed into law. The draft bill is facing head winds from some prominent Democrats. Sen. Brain Schatz (D-Hawaii), a lead negotiator in past privacy talks on Capitol Hill, warned panel leaders in a letter Wednesday that their latest effort to pass a law was “falling short” in protecting consumers. Schatz urged lawmakers to “refuse to settle for a privacy framework that will only result in more policies to read, more cookies to consent to, and no real change for consumers.”
Schatz urged panel leaders to advance a proposal that imposes a duty of care on companies to protect the personal data of users and said that if they cannot, they “absolutely should not preempt states from adopting consumer-first online privacy reforms.” While dozens of Democrats support creating a duty of care standard for online data, it is widely opposed by Republicans
In response, Cantwell said in a statement to The Washington Post on Wednesday, “Senator Schatz is right” and “any robust and comprehensive privacy law must protect consumers’ personal data with a clear requirement that companies are accountable for the use of that data and must act in consumers’ best interests.”
Lawmakers also face a dwindling time frame to get a deal done before the midterm elections. Wicker, who has led discussions for Senate Republicans for years, is widely expected to take over as the Republican lead on the Senate Armed Services Committee, which could set back privacy talks on the Senate Commerce Committee as new leadership steps in. Sen. Ted Cruz (R-Tex.), a combative technology industry critic who has focused more on targeting allegations of “bias” by social media companies than on issues like data privacy, is in line to take over for Wicker by seniority.
Staffers on the House Energy and Commerce Committee released a bipartisan discussion draft for data privacy legislation in late 2019, but this is the first time a proposal backed by panel leaders has drawn bicameral support. Little progress had been made since 2019, even as a cascade of data privacy scandals have consumed industry giants like Facebook and Google and infuriated lawmakers on both sides of the aisle on Capitol Hill.
The article provides: