The Washington Post
House panel advances major privacy bill, striking a long-awaited grand bargain
For years, lawmakers have avoided making tough calls about what data privacy protections Congress should give consumers and how they should be enforced. That’s finally changing.
On Wednesday, the House Energy and Commerce Committee greenlit a watershed privacy bill that strikes compromises on major issues that have long vexed negotiators.
It marks the first time a federal consumer privacy bill has made it out of committee.
The amended version of the bill 53-2, H. R. 8152, showcases key trade-offs struck by Democrats and Republicans. Led by Chairman Frank Pallone Jr. (D-N. J.) and ranking Republican Cathy Mcmorris Rodgers ( Wash.), it is the most significant attempt ever to pass a law.
Most notably, the proposal brokers a bipartisan compromise by overriding most state privacy laws, as Republicans have sought, in exchange for granting consumers a right to bring lawsuits against violators, which Democrats have called for.
The mutual concessions don’t end there. The bill includes versions of numerous Democratic asks, including civil rights protections against discriminatory uses of data, in pared-back forms more palatable to Republicans. While seen less favorably by Democratic-allied consumer advocates, they are less likely to face pushback from business groups arguing that more sweeping requirements would make compliance too burdensome.
“Everybody is coming to terms with the fact that this is going to have to be bipartisan, and nobody’s going to get everything that they want,” said Sara Collins, senior policy counsel for consumer group Public Knowledge, which backs the bill.
The latest version includes recent changes that appear directly aimed at addressing concerns of a prominent detractor.
Senate Commerce Chairwoman Maria Cantwell (D-wash.), whose panel controls the bill’s fate in the upper chamber, has railed against the proposal for delaying when consumers can bring lawsuits against companies by four years. The latest version reduced it to two years. There’s also an expanded section regarding forced arbitration, a key sticking point for Cantwell.
The updated measure also expressly states that California’s newly minted enforcement agency can uphold the act, a nod to criticisms from the state’s Democratic officials.
James Czerniawski, senior policy analyst at the libertarian advocacy group Americans for Prosperity, said ahead of the markup that “you could see some concerns get raised” by Republicans over expanding the private right of action and explicitly carving out a role for California’s regulators.
While some Republicans expressed reservations about that language at the session, they all voted in favor of the bill. Only two California Democrats, Reps. Anna G. Eshoo and Nanette
Barragán, voted against it, objecting that it overrides their state law.
The bill appears to address concerns by children’s privacy advocates about a loophole that could let companies dodge scrutiny for serving targeted ads to children and teens if firms didn’t know it was happening. The updated bill only applies that more limited standard to smaller firms. Larger companies could be held accountable if they knew or should have known about it.
The latest tweaks appear to give up ground both ways.
The latest version exempts small businesses from facing lawsuits by individuals. It also makes the Federal Trade Commission the sole enforcement agency overseeing data privacy, with a few exceptions, preempting the role of the Federal Communications Commission. Republicans have long challenged the FCC’S ability to enforce privacy rules in the telecom sector.
“The American Data Privacy and Protection Act’s national standard is stronger than any state privacy law,” Mcmorris Rodgers said in a statement to The Technology 202. “It prohibits Big Tech from tracking and exploiting people’s sensitive information for profit without their consent, protects kids, and ensures small businesses can innovate.”
The compromises didn’t just come “out of the blue,” though, Collins said. Discussions, negotiations and even major proposals on data privacy have existed for years. But this time, she said, congressional leaders made clear they were set on finishing the job.
“It came out of the gates very serious and it seems clear, especially from Palone and Mcmorris Rogers, that they want it to get something done … and that they were going to pressure people into getting stuff done, and that it was going to be a negotiation,” she said.
The negotiations aren’t over, however. The measure faces major hurdles in the Senate, and it remains to be seen whether House lawmakers have done enough to overcome them.