[co-author: Melissa Monaghan]
Although longtime advocates of federal privacy legislation have learned through experience not to hold their breath, this month brought reason for renewed optimism as House representatives and stakeholders reaffirmed strong bipartisan commitment to enacting a national data privacy law.
On March 1, the House Committee on Energy and Commerce’s Innovation, Data, and Commerce Subcommittee held a hearing titled “Promoting U.S. Innovation & Individual Liberty through a National Standard for Data Privacy.” This hearing focused specifically on the bipartisan American Data Privacy and Protection Act (ADPPA), which looks to be the most likely privacy bill to make it through the bicameral legislative process. Indeed, this month’s committee hearing showcased a widespread recognition that data is increasingly central to modern commerce, yet the United States continues to lag behind the rest of the world. America is failing to be a global leader when the need for a comprehensive federal regime to regulate data use issues, such as consumer privacy and data security, has never been clearer. Representatives from both parties and diverse stakeholder groups uniformly expressed support for a comprehensive federal privacy standard that changes the status quo regarding treatment of consumer data and shifts the burden of privacy protection from individual consumers to industry. Speakers also raised specific concern about the civil rights implications and unappreciated psychosocial impact these novel advertising modalities may have on children and marginalized groups who increasingly engage with the world online. Data brokers emerged as the universal object of ire and perhaps only stakeholder interest not broadly voiced at this latest hearing. Most significantly, a surprising number and variety of arguments were echoed rather than countered from across the aisle—all of which portends some sort of real movement forward from this Congress. And the ADPPA looks again to be the centerpiece of these efforts.
The draft ADPPA moved through the House Energy and Commerce Committee last summer with an overwhelming vote of 53 to 2. It stalled, however, when Speaker Nancy Pelosi declined to bring the bill to full House vote because of concerns that it would preempt California's stronger privacy protections. While Pelosi is no longer Speaker of the House (and the current Speaker, Kevin McCarthy, certainly doesn’t share the same concern about Pelosi’s constituents), California lawmakers and state officials are still vocally opposed to any federal privacy legislation that would preempt the more extensive protections California residents currently enjoy under the CCPA.
And while Congress meanders, other state lawmakers have not hit the brakes on legislative efforts to protect their citizens in the absence of meaningful federal protections for consumer privacy and data security. As of mid-March, Iowa joins California, Colorado, Virginia, Utah, and Connecticut as one of the growing number of states with a comprehensive privacy law. This intensifying patchwork of state laws—which many stakeholders hope a federal regime will unify—may pressure legislators to act more urgently on this critical matter. Clearly, the preemption issue remains a potential sticking point that must be resolved if members want to cultivate true bipartisan support for the draft ADPPA.
Only time will tell if the ADPPA offers the right mix of compromises to appease the current (typically partisan) House. Even then, a relatively long and potentially treacherous journey awaits it; bicameral legislation takes time, and politicians will be unpredictable as ever this session. All of this means it will still be a while before any comprehensive federal privacy legislation takes meaningful effect. But industry and consumers alike should take note that momentum is building, optimism appears bipartisan, and change is surely in the air.
