Bloomberg Law
Free Newsletter Sign Up
Bloomberg Law
Free Newsletter Sign Up

Federal Privacy Law Would Override States Under Draft Plan (1)

Nov. 29, 2019, 5:08 PMUpdated: Nov. 29, 2019, 7:56 PM

Big technology companies such as Alphabet Inc.‘s Google could sidestep a growing threat of state privacy laws under a discussion draft being circulated by the office of Senate Commerce Chairman Roger Wicker.

The United States Consumer Data Privacy Act would prevent states from enforcing data privacy or security laws that would affect companies covered by the proposal, according to the discussion draft. The measure wouldn’t preempt state rules that require businesses to notify consumers in the event of a data breach, under the draft language.

The preemption provision differs from privacy legislation released Nov. 26 by committee ranking member Maria Cantwell (D-Wash.) that would allow states to pass their own privacy rules, like those in the California Consumer Privacy Act.

Spokespeople for Wicker (R-Miss.) declined to comment when reached Nov. 29.

Democratic Privacy Bill Allows Lawsuits Over Data Violations

Republican lawmakers, technology companies, and some privacy advocates have been pushing for a federal privacy law that would override a possible patchwork of state privacy rules. But Democrats and other privacy advocates have pushed for measures that would keep state laws intact by setting a floor of new consumer privacy rights.

Cantwell’s bill would allow consumers to directly sue technology companies for privacy violations. The draft discussion language from Wicker’s office doesn’t include a private right of action, but would allow state attorneys general to bring civil actions on behalf of consumers for alleged privacy violations. The Federal Trade Commission would have primary enforcement power, under the draft text.

The discussion draft also takes aim at how algorithms that manage data could violate federal anti-discrimination laws. The FTC would work with other state and federal agencies if it found companies were using data from a discriminatory algorithm, according to the draft language. If the agency, for example, found an algorithm led to housing discrimination, it would share its findings with federal and state housing regulators to enforce federal anti-discrimination laws.

The FTC also would have to submit annual reports and conduct a study examining data use that may violate anti-discrimination laws, under the draft language.

The debate over state law preemption and a private right of action will continue when the Senate Commerce, Science, and Transportation Committee holds a Dec. 4 privacy hearing featuring executives from Microsoft Corp. and Walmart Inc.

Sens. Jerry Moran (R-Kan.) and Richard Blumenthal (D-Conn.) have also been working on another proposal that may add to the committee’s privacy debate.

Competing versions of the legislation in the House and Senate mean prospects remain low for the passage of a federal privacy bill in the near future.

(Updates with additional details on the draft proposal beginning in the sixth paragraph.)

To contact the reporter on this story: Daniel R. Stoller in Washington at

To contact the editors responsible for this story: Rebecca Baker at; Keith Perine at