Senate, House members unveil a long-stalled data privacy bill
WASHINGTON — A bipartisan group of legislators in the House and Senate struck a deal on data privacy legislation Friday, proposing a bill that would allow users to opt-out of targeted advertisements and to sue Internet companies that improperly sell their data.
The legislation, though, faces a steep uphill climb to become law. The lawmakers — Sen. Roger Wicker, R-Miss., and Reps. Frank Pallone Jr., D-N.J., and Cathy McMorris Rodgers, R-Wash. — are still hoping to recruit more supporters, namely Sen. Maria Cantwell, D-Wash., chair of the Senate Commerce, Science and Transportation Committee, who has advanced more liberal priorities for online user rights. Without her support, bill to likely stall.
Still, consumer rights advocates say, the proposed compromise legislation is the biggest breakthrough to date for efforts to pass a federal privacy law; those efforts have been bogged down amid partisan disagreements.
For years, Democrats and Republicans have remained at odds over to what extent a federal privacy law should override state measures, such as the landmark California Consumer Privacy Act, and whether it should give consumers the right to bring their own lawsuits against violators.
Republicans support federal preemption of state privacy laws, fearing a patchwork of standards will make compliance difficult for businesses, while Democrats have sought a broad private right of action to give consumers legal tools when government enforcement fails.
The legislation unveiled Friday seeks to strike a compromise, including a limit on when and how users can sue Internet companies and measures that would supersede most state digital privacy laws. Politico first reported news of the deal.
The bill would require companies to minimize their data collection practices to only what is specifically necessary for the function of their business, and would prevent organizations from charging users to access data privacy measures, except for narrow circumstances such as consumer loyalty programs or collecting financial data to complete a transaction.
The Federal Trade Commission would be required to maintain a public registry of data brokers and create a mechanism for users to opt-out of targeted advertisements and other data sharing practices. Under the legislation, users would have the right to access, correct and delete their digital data, and companies would be responsible for informing third parties to make changes to the data of users who so choose.
Corporate executives would be required to certify annually that their organizations are in compliance with the law.
To enforce the new requirements, the FTC would create a new bureau to protect consumer data privacy, and federal regulators and state attorneys general would be empowered to sue groups thought to be in violation of the law for punitive damages.
Individuals could also sue companies, but only after a four-year waiting period from when the legislation is enacted. They are required to notify state and federal officials before pursuing a lawsuit, and could not pursue the legal action if a government prosecutor takes up their case.
The bill would also supersede most state data privacy laws, except for specific statutes on civil rights, student and employee privacy, criminal codes and financial and health records.
“This draft shows that there is a bipartisan path forward on long-overdue legislation to protect consumers’ privacy,” said Alexandra Reeve Givens, president and chief executive of the Center for Democracy & Technology, a nonprofit tech research group that receives funding from companies including Meta, Apple and Google. “Americans want and desperately need legislation to protect their personal data and promote trust in the online world. While it’s not perfect, the draft is a hopeful first step.”
Internet trade association TechNet said the proposal “shows the engines are revving on this issue in a way they haven’t in a long time.”
“While the bill still needs further improvements, it’s an indication that leaders from both parties are committed to action and willing to compromise on key issues like a private right of action and preemption,” Carl Holshouser, the group senior vice president, said.