Is a national data privacy law on the horizon? Lawmakers are considering a bill that would override state laws and give consumers a private right of action.
04/11/2024 10:25 A.M.
3.5 minute read
House and Senate committee leaders have released a draft bill that would create a first-of-its-kind national data privacy standard.
U.S. Sen. Maria Cantwell, D-Wash., chair of the Senate Committee on Commerce, Science and Transportation, and U.S. Rep. Cathy McMorris Rodgers, R-Wash., chair of the House Committee on Energy and Commerce, unveiled the bill last weekend.
“This bipartisan, bicameral draft legislation is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information,” Cantwell and McMorris Rodgers said in a joint statement.
The American Privacy Rights Act includes a number of requirements for companies that maintain consumer data. It would, among other things:
- Require a consumer’s affirmative express consent before sensitive data can be transferred to a third-party.
- Require companies to let people access, correct, delete and export their data.
- Allow consumers to opt out of a company’s use of algorithms to make decisions about things like housing, employment, health care and credit opportunities.
- Prevent companies from enforcing mandatory arbitration in cases of substantial privacy harm.
- Give consumers a private right of action if companies violate the law.
Notably, the federal law would override the data privacy laws that more than a dozen states have enacted so far.
“A single, national privacy law will provide far greater stability and predictability for industry,” J. Trevor Hughes, president and CEO of the International Association of Privacy Professionals, told Bloomberg Law. “Many states have stepped up to fill that gap, but their approaches differ in many ways.”
Small businesses that don’t sell their customers’ personal information are exempt from the requirements of this bill, as are companies that collect or process covered data on behalf of federal, state and local governments.
Feedback on the bill from legislators and industry groups has been trickling in all week.
House Energy and Commerce Committee Ranking Member Frank Pallone Jr., D-N.J., said the draft bill is “very strong,” but noted that “there are some key areas where I think we can strengthen” it.
Senate Commerce Committee’s Ranking Member Sen. Ted Cruz, R-Texas, released a statement that he “cannot support any data privacy bill that empowers trial lawyers, strengthens Big Tech by imposing crushing new regulatory costs on upstart competitors or gives unprecedented power to the FTC.”
Going Forward
The bill will need to be introduced into both chambers and advanced by each committee to be passed into law. According to a client alert from Brownstein Hyatt Farber Schreck LLP, the legislation faces numerous challenges, including likely opposition to the bill’s state preemption provisions.
Similar legislation (H.R. 8152) passed out of the House Energy and Commerce Committee last Congress by a 53-2 margin but did not advance in either chamber. Plus, McMorris Rodgers will be leaving Congress in January, “which gives lawmakers a short window to push the legislation through during a contentious election year, when legislating is notoriously difficult,” reporter Riley Beggin notes.
When H.R. 8152 was introduced, ACA International advocated for federal data privacy legislation that avoids creating a patchwork of requirements for regulated entities that also conflict with existing laws and regulations.
“ACA appreciates that the legislation is designed to preempt many state privacy laws because all Americans deserve to receive a uniform level of privacy protections,” said CEO Scott Purcell in a letter (PDF) to McMorris Rodgers and Pallone,” ACA previously reported. “Nonetheless, there are specific exceptions contemplated in this legislation that will result in an unnecessary and complicated patchwork of privacy protections.”
Next week, the Subcommittee on Innovation, Data and Commerce will hold a hearing to discuss multiple legislative solutions to protect Americans’ data privacy rights, including the new American Privacy Rights Act.
The April 17 hearing will be open to the public and will be live streamed online at https://energycommerce.house.gov/. Learn more here.
ACA will provide updates on the bill in ACA Daily, and for more federal and state legislation updates, members are invited to join the weekly ACA Huddle at 11 a.m. CDT on Wednesdays.
Remember, subscribe to ACA Daily and Member Alerts under your My ACA profile when logged in to acainternational.org to receive updates on the ACA Huddle.