Officials in California who oppose a federal privacy bill and are used to having the ear of Speaker Nancy Pelosi will face a tougher slog to influence the legislation in a Republican-controlled House.
The American Data Privacy and Protection Act (
Americans, increasingly wary of being tracked by tech companies, want greater control over how their data is collected and used. Tech companies are pushing for uniform, nationwide regulations as more states advance privacy legislation. And, amid congressional inaction, the US is trailing behind other countries that have enacted national privacy laws.
Lawmakers broke decades of gridlock with committee approval of the ADPPA this year, but concerns from California officials about undermining their state’s regime and opposition from key senators makes final passage unlikely in the lame-duck session. Hill watchers say McCarthy wouldn’t bring the same level of loyalty to the Democrat-run state.
“McCarthy is not going to be beholden to Newsom the way Speaker Pelosi is,” Public Knowledge Government Affairs Director Greg Guice said, referring to California Governor Gavin Newsom.
Outcry against the landmark bill’s threat to California has by and large come from Democrats.
At the state level, Newsom, Attorney General Rob Bonta, and the California Privacy Protection Agency, which is led by a Newsom appointee, have come out against it. Their concerns made it to Capitol Hill via Pelosi and other California Democrats, most notably Reps. Anna Eshoo and Nanette Barragán — the only two lawmakers who voted against advancing the bill out of the House Energy and Commerce Committee.
McCarthy has backed the idea of federal privacy legislation but has not taken a position on the ADPPA. In an interview with the Washington Post earlier this year, Rep. Cathy McMorris Rodgers (R-Wash.), who’s in line to chair the committee that oversees privacy as its top Republican, didn’t say whether McCarthy has committed to bringing the ADPPA to a vote. She instead pointed to the Republican agenda of confronting big tech.
That playbook, spearheaded by McCarthy, includes providing Americans greater privacy protections. His support for preemption—or the federal overriding of state measures to provide businesses clear guidance and certainty—is in line with many Republicans. Democrats historically have advocated for a federal law that sets a floor, not a ceiling, for privacy expectations so that states can implement more aggressive standards where there’s buy-in for that.
The ADPPA reflects a middle ground on that issue. It preempts state laws overall but leaves open more than a dozen areas where states can continue to have stricter measures, for example, in the areas of health care, student records, identity theft, biometrics, and wiretaps.
However, California officials say that’s not enough. In a Sept. 27 op-ed CPPA Chair Jennifer Urban, said the passage of the federal bill would make Californian’s privacy protections “disappear.”
No Republican members of the California delegation serve on the House panel with jurisdiction over privacy, but some who have an interest in the tech industry have spoken out against a patchwork of state laws.
Jonathan Wilcox, communications director for Rep. Darrell Issa (R-Calif.), said the lawmaker does not support having a variety of individual state laws that would burden businesses. Issa is an honorary co-chairof the Information Technology and Innovation Foundation and the founder of Directed Electronics, a car product manufacturer he no longer operates.
Rep. Jay Obernolte (R-Calif.), a computer scientist and the owner of video game developer FarSight Studios who is bidding for a seat on Energy and Commerce, has also come out against a patchwork of state laws.
As a member of the California state assembly, Obernolte was heavily involved in drafting the California Consumer Privacy Act. Obernolte said he has remaining issues with the state law and how agencies implemented it that he hopes a preemptive national law can resolve, though he’s sympathetic to the California privacy agency not wanting some of its purview taken away.
Republicans have relayed concerns to McCarthy about certain restrictions on businesses’ access to data, according to Stu Ingis, co-chair of Venable’s privacy group, and counsel to the Privacy for America coalition, which is made up of advertisement industry groups.
Even though no Energy and Commerce Republicans voted against the ADPPA in committee, several expressed persisting concerns, signaling their votes on the full House floor were not a guarantee.
“People were willing to hold their tongues for the moment,” said Lartease Tiffith, executive vice president for public policy at the Interactive Advertising Bureau, which is a member of the Privacy for America coalition.
Ad industry players have taken issue with the ADPPA’s restrictions on the collection and use of third-party data, which usually comes from a consumer’s social media interactions, search history, or online transactions. Advertising companies use consumer data to market products and services to relevant audiences.
Chris Pedigo, senior vice president for Digital Content Next, said his group is continuing to speak with Hill offices about “common sense” changes. The trade organization represents online media companies.
Several industry groups said they believe there will be buy-in from McMorris Rodgers to rehash some of those issues. “Even though bipartisanship will continue, Republicans have the pen now and will get to make the final decision,” Ingis said.
Asked whether she would be open to business-friendly changes to the bill if it does not pass in this Congress, McMorris Rodgers said she is “committed to the strongest protection of privacy we can get. Yes, we’ll keep working on it to make it the best bill possible.”
Private right of action language in the bill, which would allow individuals to directly sue companies for privacy violations, was a big win for Democrats but continues to face pushback from industry that a Republican-controlled House might be more sympathetic to.
“Private right of action is a terrible idea. I do not think it should be part of any federal data privacy legislation,” Obernolte said, adding he believes McMorris Rodgers has done an “amazingly good job at trying to put together a compromise.”
The changes might mean losing some Democrats along the way in the House and further alienating key Democrats in the Senate who believe the enforcement mechanisms of the ADPPA, including the private right of action, are not strong enough. With only a slim majority in the lower chamber, it will be a delicate balance to strike for McCarthy and McMorris Rodgers, advocates said.
“Reopening some of these deal-breaking but well-compromised issues might end up killing the bill,” Guice said. “That’s not what McMorris Rodgers wants.”