Some critics have described the current situation in the Senate as “analysis paralysis” as lawmakers clash swords over Pre-emption and Private Right to Action — the two data privacy issues causing polarised political discourse between the two sides of the house.
Last week’s SCST Committee hearing suggests any agreement over the finer points of implementation and enforcement are as unlikely as ever.
It’s hardly surprising that Data Privacy is once again under the spotlight, following Republican lawmakers’ proposals for a national privacy structure requiring organisations to reveal data collection details. Businesses must also disclose processing and transfer activities more transparently while giving consumers an easy way to access, correct, delete and transfer their data to any other service.
After lawmakers were allowed to present their views on legislating national privacy standards during the hearing, Xavier Becerra, California’s Attorney General, and a select group of former FTC officials reiterated the need for a comprehensive bill.
Sen. Roger Wicker, R-Miss., chaired the hearing just a few days after unveiling the SAFE DATA Act of September 17. The Act is said to strengthen the FTC’s ability to hold businesses accountable for the misuse of personal data by allowing the commission to obtain financial remedies for consumers, develop new regulations to widen the scope of sensitive personal data, and establish a data broker registry.
Having been fuelled by the European Union’s General Data Protection Regulation (GDPR), the Commerce Committee has held hearings to examine the possibilities for enacting data privacy regulations that would apply nationwide. However, although both Democrats and Republicans agree that such measures are fundamental, they failed to agree on several key points, including whether individual states should set more rigid rules and whether citizens should be permitted to bring private suits for violations of their personal information.
The influential position presented by the privacy experts is that Republicans and Democrats agree with the need to pass national data privacy legislation and should therefore quit squabbling over the differences that exist to make swift and sustained progress on getting privacy legislation passed as quickly as is humanly possible.
There are two significant differences currently delaying meaningful progress in the house; a) the widespread view that federal law should pre-empt state laws, and b) how enforcement will actually work in practice. Republicans have argued that federal legislation should supersede individual state laws and that the FTC should enforce them. But Democrats say states should be permitted to innovate beyond the federal standard. They also advocate a bill giving consumers a private right of action.
Both Democrats and Republicans have agreed in principle that legislation is necessary. But, they continue to disagree on whether individual states should be free to implement stricter rules and whether consumers should have the right to bring lawsuits calling for damages for alleged violation of their data.
Armed with his experience implementing the California Consumer Privacy Act (CCPA), AG Xavier Becerra’s testimony served as a mouthpiece for the pre-emption argument. Becerra is also an advocate for the right to private action.
Cantwell and other Democrats are disturbed that pre-emption could hinder states like California from innovating beyond the national minimum. Instead, they hope to tie states that have not yet adopted data privacy laws into a national standard without inhibiting those states that wish to innovate beyond federal law.
Former Chairman and FTC Commissioner Jon Leibowitz and some other witnesses said the bills proposed by Cantwell and Wicker already go substantially further than the CCPA. However, Leibowitz also stated that he would not support pre-emption if, in his judgment, federal law would be weaker than state laws.
William Kovacic, also a former FTC chairman and commissioner, piped in with his support for awarding rule-making authority to the FTC to adopt a federal data privacy standard whenever new issues appear.
The internet, by its very nature, does not recognise state boundaries. Therefore any state-implemented extensions of the law would become the de-facto standard nationwide since a business that has to comply with, e.g., the CCPA, will comply with California’s law and outside of California’s borders.
Meanwhile, Kovacic did not think individual states would feel any sense of urgency to push forward if they believed a national scheme would be adaptable and flexible.
Private Right of Action
Cantwell articulated a strong stance regarding the need for enabling citizens to seek redress on their own in the event of a violation of their privacy rights. Cantwell said that even if Congress empowers the FTC and state AGs to enforce a national data privacy standard, there will never be sufficient resources to police the deluge of organisations collecting consumers’ data.
In response to questions from Cantwell, Becerra said that the private right of action makes legal protections tangible. Citizens must have remedies available to them for their rights to be meaningful.
Both Democrats and Republicans agreed that the FTC should be given extra resources to enforce privacy regulations. However, Cantwell and Becerra argued that citizens still need that additional outlet to advocate for themselves since the FTC and state AGs will never have sufficient resources to deal with every problem that rears its head.
Responding to Cantwell’s questions, AG Becerra submitted that a private right of action would make protections tangible. People need to have remedies available for their rights to be meaningful.
Both sides agree that the FTC should have additional resources to enforce privacy regulations effectively. Becerra and Cantwell argued that consumers need to have another outlet to advocate for themselves. Unfortunately, the FTC and state attorneys are never likely to have adequate resources to deal with every problem.
Former FTC Commissioner Maureen Ohlhausen said in a written testimony that in past instances, private rights of action have often just lined the pockets of attorneys without achieving proper redress for victims. She added that leaving enforcement up to state attorneys general and the FTC would create a level of consistency that benefits consumers more than individual attempts to realise a more positive outcome.
So, there we have it. Analysis Paralysis— at least for now. Isn’t this the way things generally go in the Senate — however complicated or straightforward the resolving of differences can be?