The Year Ahead: Push for privacy bill gains new momentum

Congress is seeing a new flurry of activity toward drafting a national privacy law as major breaches mount and the public’s anger over companies’ data policies grows.

The calls for a privacy bill have been growing louder in recent months. And for Republicans and industry groups, the need for a set of federal data rules has gained new urgency since this summer, when California passed the toughest state law in the nation giving users unprecedented control over their information.

Major trade groups representing internet giants want any bill that Congress comes up with to pre-empt state laws like California’s out of concern that they’ll have to navigate conflicting — and stringent — data regulations in each state.

ADVERTISEMENT

“I’m of the opinion that we are better off with more of an overarching data protection framework for users, and I think that would be good to do,” Google CEO Sundar Pichai told the House Judiciary Committee on Tuesday.

In the Senate, Commerce, Science and Transportation Committee Chairman John ThuneJohn Randolph ThuneCongress should take action to stop unfair taxation of the digital economy The fear of colorectal cancer as a springboard for change Senators offer bipartisan bill to fix 'retail glitch' in GOP tax law MORE (R-S.D.) has said he is preparing to work on privacy legislation and in September convened a hearing with top executives from Silicon Valley on the issue.

A spokesperson for Sen. Jerry MoranGerald (Jerry) MoranThe 25 Republicans who defied Trump on emergency declaration Overnight Defense: Senate rejects border emergency in rebuke to Trump | Acting Pentagon chief grilled on wall funding | Warren confronts chief over war fund budget 12 Republican senators defy Trump on emergency declaration  MORE (R-Kan.), who’s helping craft legislation as part of a bipartisan working group, said the lawmaker is “encouraged” that his colleagues are putting forth proposals.

“Sen. Moran continues to engage with members of the working group toward bipartisan and comprehensive privacy legislation,” the aide said.

Across the Capitol, Democrats are poised to take the House in January. Rep. Frank Pallone Jr.Frank Joseph PalloneBooker takes early lead in 2020 endorsements Hillicon Valley: EU hits Google with .7 billion antitrust fine | GOP steps up attack over tech bias claims | Dems ask FTC for budget wishlist | Justices punt on Google privacy settlement Dems ask FTC if it needs more money to protect privacy MORE (D-N.J.), who is expected to take the gavel on the powerful House Energy and Commerce Committee, has also said he will work on privacy legislation. Pallone has spoken about a broader internet law that would include principles on privacy and data protection.

Lawmakers have made it clear they are eager to see movement on the issue sooner rather than later due to their broader frustration with internet giants and the increasing number of data scandals.

On Wednesday, Sen. Brian SchatzBrian Emanuel SchatzLawmakers urge tech to root out extremism after New Zealand Advocate says Trump administration's new proposal would do 'absolutely nothing' to alleviate student debt Hillicon Valley: Huawei official asks US to ease restrictions | Facebook loses top execs | Defense officials hit Google over China | Pro-Trump 'safe space' app pulled over security flaw | Senators offer bill on facial recognition technology MORE (D-Hawaii), along with 14 Democratic co-sponsors, became the latest to propose privacy legislation.

Other proposals have sought to create protections for consumers, but Schatz’s Data Care Act would impose a fiduciary responsibility on any company that collects internet user data to protect that information and not use it in a way that harms the user.

It would also empower the Federal Trade Commission (FTC) to impose rules about data collection and issue fines to first offenders, powers that the consumer protection agency currently lacks.

“In the long run, the reason to lay down broad principles and let the FTC referee this is that we have no idea what kind of data will be collected 15, 25 years from now and we want a statute that can stand the test of time and not be overtaken by events — especially [the internet of things],” Schatz told a group of reporters in his office on Wednesday.

“We don’t want to write this to solve just the Cambridge Analytica problem and then find ourselves with shopping malls that are collecting trillions of bits of data on you and our data privacy bill ... already moot.”

Schatz believes Democrats will have increased leverage as talks move forward and his party takes over the House.

“I think in the end the opportunity to make meaningful progress on privacy legislation and do something really progressive at the national level is as a result of the pressure that tech is feeling about the possibility of say 50 different state statutory and regulatory regimes,” he said. “That fear is driving them to be newly enthusiastic about national privacy legislation.”

“We get to test their sincerity about getting meaningful privacy legislation done,” Schatz added.

The series of data incidents in recent years have rattled lawmakers and the public. Most recently, Marriott announced that hundreds of millions of its customers had their data stolen in a breach. That has many growing increasingly impatient about the lack of concrete action on privacy despite the mounting scandals.

“Right now, there’s a lot of chopping, but I don’t see any chips flying,” Sen. John KennedyJohn Neely KennedyMORE (R-La.) told The Hill last week,.

In April, Kennedy introduced a bipartisan internet privacy bill with Sen. Amy KlobucharAmy Jean KlobucharHere's what the Dem candidates for president said about the Mueller report Booker takes early lead in 2020 endorsements Harris wants Barr to testify on Mueller report as 2020 Dems call for its release MORE (D-Minn.) that gave users more control over their data. But the bill stalled in the Senate.

Kennedy said last week that he’s in the early stages of coming up with his own bill, but noted the fight is likely to drag on.

“Everybody’s talking, but nothing’s moving in terms of legislation,” he said.

And there is little indication that lawmakers are any closer to resolving the biggest question for federal privacy legislation.

Schatz believes talks on a privacy bill will center around the issue of whether to pre-empt states from creating their own privacy standards. He said he’s open to it, but “only if we’re replacing a progressive law with a more progressive law.”

“I don’t think they’re ready to jump on any of these ideas, even the ones they may not object to, until and unless preemption is on the table,” he said of Republicans. “And we’re not ready to put pre-emption on the table until we negotiate a pretty big package.”

Lawmakers are also getting more input from consumer groups and industry associations alike with organizations across the spectrum submitting legislative wish lists.

For privacy advocates, the desire is to see Congress force companies to be more mindful of how their data policies impact consumers.

“I’m not sure where Congress is headed, but we want to make sure that any legislation is centered on shifting privacy burdens from the user back to the companies and other entities that hold their data,” said Michelle Richardson, director of the Center for Democracy and Technology’s privacy efforts.

But whether that enthusiasm translates into results is an open question.

Richardson said she would be watching the next Congress closely to see how quickly the privacy effort is advanced.

“There are so many moving pieces right now and it’s not clear what approach Congress wants to take — how broad or narrow they want to go,” she said. “The first six to nine months of next year will probably be determinative about whether this is a one-year plan or more like a five-year project.”