On February 26 and 27, 2019, the House Subcommittee on Consumer Protection and Commerce, and the Senate Committee on Commerce, Science, and Transportation, respectively, held hearings to explore the potential passage of a national privacy law. In both houses, members of Congress and the panelists agreed that the federal government should enact legislation to protect consumers’ private data without stifling innovation or hurting small businesses. Both hearings were full of much discussion but minimal agreement about the scope and framework of such a law. There were, however, a few takeaways that could offer insight into what a national privacy law might – eventually – look like.
Consumer choice. Both hearings discussed the current problems with the notice and consent regime, which in many instances did not provide consumers with a genuine ability to choose. Janice Schakowsky (D-IL), the House Committee Chair, began the question-and-answer portion of the House discussion by noting how many privacy policies she encountered in a 24-hour period, and how it was nearly impossible to read and understand them all. House Energy and Commerce Chairman Frank Pallone (D-NJ), thought that the current notice and consent system was unfair to consumers as it provided no actual choice. Senate Committee Chair Roger Wicker (R-MS) acknowledged that consumers needed “transparency and choice.” Senator John Thune (R-SD) did not think that companies were currently transparent, citing the recent Google Nest thermostat microphone, and noted that transparency was needed to permit consumers to actually make informed decisions.
Enforcement. It was nearly universally agreed that the Federal Trade Commission (FTC) needed strong enforcement mechanisms for any national law. Everyone who touched on the point thought that the FTC should have the authority to punish first-time offenders. There was general agreement that the current regime, which limits the FTC to negotiating a consent agreement for a first violation and only provides the FTC with authority to impose a fine when such agreement is violated, did not effectively protect consumers. There was also a consensus that the FTC needed express rulemaking authority (beyond their current, somewhat limited and inefficient rulemaking authority under the FTC Act) to address changing technology, although the scope of such authority remained open for debate. During the Senate hearing, many of the panelists spoke favorably of providing state Attorneys General with additional enforcement authority. Unsurprisingly, the panelists, who predominantly represented industry groups, did not advocate for the inclusion of any private rights of action.
Preemption. Preemption remained the elephant in the room. Maria Cantwell (D-WA), ranking member of the Senate Committee, abruptly asked if the only reason that anyone was advocating for a federal privacy law was to avoid the obligations of the CCPA. Republicans such as Senator Wicker thought a preemptive framework was necessary to provide consumers with certainty that they will have robust data protections wherever they are in the United States. Representatives Cathy McMorris Rogers (R-WA), the ranking member of the House Subcommittee, and Fred Upton (R-MI) were also concerned about the burden a patchwork of privacy and security laws that differed by state would place on businesses, especially small businesses and start-ups. The panelists largely advocated for preemption, but the Senate panelists claimed they were not opposed to a federal privacy law that used the CCPA as a floor, albeit with some “adjustments.”
In sum, there are undoubtedly key points where the panelists, senators and representatives seemed to be in agreement: more transparency, consumer choice, FTC enforcement for first-time violators, and at least some FTC rulemaking. The overarching details, however, seem to be far from settled. At this time, businesses should continue to build privacy programs that comply with the CCPA, GDPR and other privacy laws. These programs can be implemented flexibly, which can help prepare businesses for a federal law that may be just around the corner.