The State of Play for Federal Data Privacy Reform

Last week, two key House Committees were busy on the data privacy front.

The House Financial Services Committee marked up Chairman Patrick McHenry's (R-NC) H.R. 1165, the Data Privacy Act of 2023. The bill was reported favorably to the full House with a vote of 26-21, which fell along party lines. The legislation would amend the Gramm-Leach-Bliley Act (GLBA) to grant consumers additional rights when it comes to their financial information-such as the right to opt-out of companies sharing that information with unaffiliated third parties, or the right to delete information a company has collected about an individual-while imposing transparency and collection obligations on financial institutions and their use of consumer data. Importantly, the legislation also preempts state laws when it comes to similar data.

The legislation passed out of the Committee over several concerns and numerous amendments from Ranking Member Maxine Waters (D-CA) and other Democratic members, including fears over the federal preemption of stronger state privacy laws such as those in California.

The legislation now enters a holding pattern with the next steps a little unclear. Further notes covering the markup can be found here.

This bring us to the other committee action where the House Energy and Commerce's Innovation, Data and Commerce (IDC) subcommittee held a hearing entitled "Promoting U.S. Innovation And Individual Liberty Through A National Standard For Data Privacy." Members on both side of the dais touted the committee's work last year on the American Data Privacy and Protection Act (ADPPA). In the 117^th Congress, then-Chair Frank Pallone (D-NJ), Ranking Member Cathy McMorris Rodgers (R-WA), and Senate Commerce Ranking Member Roger Wicker (R-MS) came to a three-corners compromise agreement and introduced the ADPPA. Senate Commerce Chair Maria Cantwell (D-WA) however withheld her support, backing stronger enforcement provisions within the private right of action language. House Energy and Commerce marked up and passed the legislation out of the full committee only to be held up before floor consideration by then-Speaker Nancy Pelosi (D-CA) over concerns that the legislation's preemption language would supplant California's state privacy law, the California Consumer Privacy Act (CCPA).

This Congress, the ADPPA and other comprehensive privacy reform face similar head winds. During the hearing Wednesday, now-Chair Rodgers and Ranking Member Pallone continued to express support for the ADPPA. However, some Democratic members raised concerns about federal legislation preempting stronger state privacy laws, while Republicans expressed apprehension at language that does not go far enough in preempting state laws and creates a confusing patchwork of state and federal obligations.

While the timeline for reintroducing the ADPPA is still up in the air, a number of other factors are also at play including what changes (if any) Chair Rodgers will make to the ADPPA's language and whether that influences Democratic support. It's also unclear if House Republican Leadership is willing to bring the legislation to the floor. The dynamics in the Senate with Chair Cantwell still withholding support and where newly-appointed Senate Commerce Ranking Member Ted Cruz (R-TX) stands on broader privacy legislation will all be at play too.

Further notes for the E&C hearing be found here.

While congressional data privacy efforts continue to ramp up, state general assemblies and federal agencies are not waiting for Congress to take action. More than a dozen state general assemblies have (re)introduced comprehensive or data-specific privacy proposals, adding to the five states that have already enacted laws. Moreover, the Federal Trade Commission (FTC) is purportedly still engaged in ongoing privacy rulemaking under its Section 5 "unfair or deceptive acts or practices" authority. Last August, the FTC issued an advance notice of proposed rulemaking (ANPR) to request public comment "on the prevalence of commercial surveillance and data security practices that harm consumers." FTC Chair Lina Khan has not yet announced a timeline for finalizing a rule.

Data privacy reform will continue to be top of mind for federal and state lawmakers alike as the movement for expanding consumer rights concerning how their data is collected and used continues to build across the aisle. Be sure to check back for updates soon.

Tags

• Ensuring a Safe, Sustainable Future

• Privacy

• Public Policy

Public link

Please use the above public link if you want to share this noodl on another website.