Congress is seeing a new flurry of activity toward drafting a national privacy law as major breaches mount and the public’s anger over companies’ data policies grows.
The calls for a privacy bill have been growing louder in recent months. And for Republicans and industry groups, the need for a set of federal data rules has gained new urgency since this summer, when California passed the toughest state law in the nation giving users unprecedented control over their information.
Major trade groups representing internet giants want any bill that Congress comes up with to pre-empt state laws like California’s out of concern that they’ll have to navigate conflicting — and stringent — data regulations in each state.
{mosads}
“I’m of the opinion that we are better off with more of an overarching data protection framework for users, and I think that would be good to do,” Google CEO Sundar Pichai told the House Judiciary Committee on Tuesday.
In the Senate, Commerce, Science and Transportation Committee Chairman John Thune (R-S.D.) has said he is preparing to work on privacy legislation and in September convened a hearing with top executives from Silicon Valley on the issue.
A spokesperson for Sen. Jerry Moran (R-Kan.), who’s helping craft legislation as part of a bipartisan working group, said the lawmaker is “encouraged” that his colleagues are putting forth proposals.
“Sen. Moran continues to engage with members of the working group toward bipartisan and comprehensive privacy legislation,” the aide said.
Across the Capitol, Democrats are poised to take the House in January. Rep. Frank Pallone Jr. (D-N.J.), who is expected to take the gavel on the powerful House Energy and Commerce Committee, has also said he will work on privacy legislation. Pallone has spoken about a broader internet law that would include principles on privacy and data protection.
Lawmakers have made it clear they are eager to see movement on the issue sooner rather than later due to their broader frustration with internet giants and the increasing number of data scandals.
On Wednesday, Sen. Brian Schatz (D-Hawaii), along with 14 Democratic co-sponsors, became the latest to propose privacy legislation.
Other proposals have sought to create protections for consumers, but Schatz’s Data Care Act would impose a fiduciary responsibility on any company that collects internet user data to protect that information and not use it in a way that harms the user.
It would also empower the Federal Trade Commission (FTC) to impose rules about data collection and issue fines to first offenders, powers that the consumer protection agency currently lacks.
“In the long run, the reason to lay down broad principles and let the FTC referee this is that we have no idea what kind of data will be collected 15, 25 years from now and we want a statute that can stand the test of time and not be overtaken by events — especially [the internet of things],” Schatz told a group of reporters in his office on Wednesday.
“We don’t want to write this to solve just the Cambridge Analytica problem and then find ourselves with shopping malls that are collecting trillions of bits of data on you and our data privacy bill … already moot.”
Schatz believes Democrats will have increased leverage as talks move forward and his party takes over the House.
“I think in the end the opportunity to make meaningful progress on privacy legislation and do something really progressive at the national level is as a result of the pressure that tech is feeling about the possibility of say 50 different state statutory and regulatory regimes,” he said. “That fear is driving them to be newly enthusiastic about national privacy legislation.”
“We get to test their sincerity about getting meaningful privacy legislation done,” Schatz added.
The series of data incidents in recent years have rattled lawmakers and the public. Most recently, Marriott announced that hundreds of millions of its customers had their data stolen in a breach. That has many growing increasingly impatient about the lack of concrete action on privacy despite the mounting scandals.
“Right now, there’s a lot of chopping, but I don’t see any chips flying,” Sen. John Kennedy (R-La.) told The Hill last week,.
In April, Kennedy introduced a bipartisan internet privacy bill with Sen. Amy Klobuchar (D-Minn.) that gave users more control over their data. But the bill stalled in the Senate.
Kennedy said last week that he’s in the early stages of coming up with his own bill, but noted the fight is likely to drag on.
“Everybody’s talking, but nothing’s moving in terms of legislation,” he said.
And there is little indication that lawmakers are any closer to resolving the biggest question for federal privacy legislation.
Schatz believes talks on a privacy bill will center around the issue of whether to pre-empt states from creating their own privacy standards. He said he’s open to it, but “only if we’re replacing a progressive law with a more progressive law.”
“I don’t think they’re ready to jump on any of these ideas, even the ones they may not object to, until and unless preemption is on the table,” he said of Republicans. “And we’re not ready to put pre-emption on the table until we negotiate a pretty big package.”
Lawmakers are also getting more input from consumer groups and industry associations alike with organizations across the spectrum submitting legislative wish lists.
For privacy advocates, the desire is to see Congress force companies to be more mindful of how their data policies impact consumers.
“I’m not sure where Congress is headed, but we want to make sure that any legislation is centered on shifting privacy burdens from the user back to the companies and other entities that hold their data,” said Michelle Richardson, director of the Center for Democracy and Technology’s privacy efforts.
But whether that enthusiasm translates into results is an open question.
Richardson said she would be watching the next Congress closely to see how quickly the privacy effort is advanced.
“There are so many moving pieces right now and it’s not clear what approach Congress wants to take — how broad or narrow they want to go,” she said. “The first six to nine months of next year will probably be determinative about whether this is a one-year plan or more like a five-year project.”