Why a bipartisan data privacy proposal faces an uphill battle

Groups on both sides of the spectrum have praised the fact that any bipartisan legislation on this issue has come out as a breakthrough, signaling that there is some appetite to fashion the bill into something that can pass through Congress.

The discussion draft, proposed by Sen. Roger Wicker (R-Miss.) and Reps. Frank Pallone (D-N.J.) and Cathy McMorris Rodgers (R-Wash.), comes after years of partisan disagreements and false starts.

The legislation would set national standards for how companies can obtain and manage data, compelling firms covered by the bill to minimize collecting data not needed for their businesses to function.

It would also tighten rules on what data can be collected on minors and allow all Americans to opt out of targeted advertising. The wide ranging bill is almost certain to be revised before being presented for a markup or vote, meaning that any section or standard could ultimately be changed.

The draft takes a new approach to the two issues that have long divided lawmakers trying to get a framework passed: whether individuals should be able to sue over violations and whether a federal framework should supercede the various state-level initiatives that have popped up over the last few years.

The draft proposal includes a private right of action, but with some limitations. Individuals would only be able to sue companies four years after the bill is enacted and would have to check with officials before filing cases. If government prosecutors, the Federal Trade Commission or state attorneys general decide to take up their case, individuals would not also be able to sue.

The ADPPA would for the most part preempt the state privacy laws that have been advanced in the absence of federal action, but would leave some exceptions for rules covering a list of topics including civil rights, data breach notifications and facial recognition technology.

The inclusion of a private right of action, no matter how limited, has drawn opposition from business groups.

A draft of a letter from the Chamber of Commerce calling the draft “unworkable” was circulated last week but has not been delivered to any congressional offices at this time and could be rewritten before getting to that point.

“We support a national data privacy law, but remain concerned about the impact of the introduction of a private right of action and are engaging with the bill sponsors on this and other issues,” Jordan Crenshaw, vice president of the Chamber’s Technology Engagement Center, said in a statement to The Hill.

Whether the Chamber, long a powerhouse in Washington, will be able to persuade lawmakers to vote against the bill at this point is unclear.

“The Chamber’s standing with Congress is at an all-time low,” a congressional aide familiar with the privacy talks told The Hill. “They have lost allies and influence in Congress very fast with policy and strategic blunders like this. This letter only guarantees their members who sign are cut out of privacy negotiations.”   

Groups representing business interests have also raised concerns about the exceptions to the ADPPA’s preemption of state legislation.

“The American Data Privacy and Protection Act fails a central requirement of any good federal privacy law: to create a national privacy standard,” Carl Szabo, vice president and general counsel of NetChoice, a tech-focused trade group that counts Amazon, Facebook and Google among its members. 

“As it stands, the bill leaves a fractured and complex national privacy environment – making it nearly impossible for Americans to know how their data is treated as they travel between states or visit different websites,” Szabo added.

Backers of the ADPPA will also have to win over critics who say it does too little in the face of an increasingly complex online ecosystem.

Sen. Brian Schatz (D-Hawaii), who has led several privacy bills in the Senate, albeit partisan ones, wrote a letter to the three lead sponsors earlier this month urging them to shift the burden of data privacy from consumers to companies by including a corporate duty of loyalty in the legislation.

“We can no longer reasonably expect that consumers understand what information they are handing over to providers or even how it is being used,” he wrote. “Collection and tracking technologies and techniques have become more sophisticated than most users can understand and, even when they can, users are often helpless to stop them.”

Sen. Maria Cantwell (D-Wash.), whose role as the chair of the Senate Commerce Committee makes her a key player in privacy negotiations, has also called for a duty of loyalty.

Cantwell has also circulated her own privacy proposal which, according to a copy obtained by The Hill, includes a stronger private right of action.

Outside observers have also raised concerns that the draft legislation could be doing too little.

Vuk Janosevic, CEO of the privacy software firm Blindnet, told The Hill that while it’s a positive that there is a proposal at the federal level, the bill falls short on how many companies it applies to and relies too heavily on letting users opt-out of data collection instead of having them opt-in.

“It’s great that we have something, truly, because today we have nothing,” he noted. “That said, I think this truly falls short behind a lot of other regulations.”

Despite opposition from both business groups and privacy advocates, there appears to be agreement across the board that simply getting a federal proposal with concessions on both sides is a big first step.

“It’s the first bipartisan bicameral comprehensive federal privacy bill that’s been put out there, period,” said Alex Brown, a partner at the law firm Alston & Bird that has been closely tracking privacy bills for the American Bar Association. 

“This draft is interesting because it shows that a lot of negotiation has taken place and there’s a good bit of compromise that’s happened specifically on private right of action and state preemption,” he added.