By Abbie Gruwell
Spurred by the European Union’s General Data Protection Regulation (GDPR) and the 2020 effective date of California’s Consumer Privacy Act (CCPA), Congress is again undertaking the elusive task of passing a comprehensive national data privacy bill.
As other states such as Washington, Massachusetts and New York move to fill the void left by Congress in the privacy arena, state preemption is the battleground issue behind any federal bill.
In the Senate, a bipartisan working group of Senators Brian Schatz (D-Hawaii), Roger Wicker (R-Miss.), Jerry Moran (R-Kan.) and Richard Blumenthal (D-Conn.) from the Senate Commerce, Science and Transportation Committee have been working on principles and a draft bill since last summer.
Progress on the bill now appears to be stalling as the working group missed its internal deadline of distributing a draft before April, and Senator Lindsey Graham (R-S.C.) has indicated that he would like the bill to go through the Senate Judiciary Committee as well. The committee has held several hearings with technology trade groups, small businesses and regulators that prompted a letter from NCSL calling for more engagement of state stakeholders.
Meanwhile, the House Energy and Commerce Committee is still in the drafting phase. Diverse factions within both chambers are making progress challenging, including a California delegation that has come out strongly against state preemption.
Many industry groups, including the U.S. Chamber of Commerce, have released model federal privacy legislation that explicitly preempts states, and, although they are the primary drivers for a national standard, it is unlikely that industry will support a bill that includes consumer protections as strong as those in the CCPA.
Republicans have indicated they want to pass a national standard before the California bill goes into effect in 2020, but the fundamental debate between a federal floor and a strong preemptive model remains unresolved.
Further complicating the debate is the issue of enforcement. A federal bill will likely give significantly greater authority to the Federal Trade Commission (FTC), possibly allowing the agency to use Section 5 of the FTC Act to impose fines for first-time violations.
The FTC currently has very limited authority to enforce data privacy violations and there is speculation about whether the FTC is the appropriate enforcement body. A federal bill will also have to address whether to grant consumers a private right of action and what violations that right would cover. Many industry groups are instead promoting an approach that requires consumers to show a certain level of harm from the violation.
In December, Schatz introduced a bill that required a fiduciary duty type standard for companies that handle private data. The “duty of care” language is likely to appear in the Senate draft, but brings up questions of interpretation and enforcement.
Both the CCPA and GDPR afford affirmative rights to consumers, including the right to know what data is collected, the right to access data, the right to delete, correct or erase, and, in California, the right to opt out of information being sold to third parties.
There are continuing debates in states and Congress about whether to apply such standards to internet service providers only or create a comprehensive system and whether to adopt a technology-neutral approach.
Congress will also struggle with basic definitions such as “access” and “personally identifying information” that will shape the scope of federal legislation. The House has indicated it will attempt to build on the work states have done in their privacy bills around definitions and applicability.
NCSL provides tracking and analysis of state data privacy, internet and data breach bills. For information, please contact Abbie Gruwell, in Washington, D.C., (firstname.lastname@example.org) or Pam Greenburg, in Denver (email@example.com).
Abbie Gruwell is the Committee Director for the Communications, Financial Services and Interstate Commerce Committee in NCSL's State-Federal Affairs office in Washington, D.C.