Lawmakers haven’t coalesced around a single approach to broad data privacy legislation in either the Senate or House, despite pressure from tech companies, privacy advocates and others to pass a bill.
Momentum in both chambers has dissipated, even after a series of high-profile data breaches and privacy scandals involving
“It’s getting late” in the process, said Cameron Kerry, a visiting fellow at the Brookings Institution. Still, lawmakers “have the political will to do this,” Kerry, a former acting Commerce Secretary in the Obama administration, said.
Republicans and Democrats remain divided over whether to pre-empt state laws like California’s, give the Federal Trade Commission broad new enforcement powers, or allow consumers or state attorneys general to sue companies for consumer harms. A group of senators working on a bill has begun to splinter, congressional aides and policy strategists said.
Senate lawmakers have been holding closed-door discussions and trading legislative proposals for months without finding a compromise.
Senate Commerce, Science and Transportation Committee Chairman Roger Wicker (R-Miss.), and fellow panel members Jerry Moran (R-Kan.), Richard Blumenthal (D-Conn.), and Brian Schatz (D-Hawaii) developed a partial legislative blueprint that would have given the FTC more enforcement powers and preempted state privacy laws, according to three Senate aides briefed on the discussions.
But the proposal stalled after Sens. John Thune (R-S.D.) and Maria Cantwell (D-Wash.) began participating in the talks, the aides said. Thune suggested major changes to the group’s initial proposal, according to four aides familiar with the process, while Cantwell never weighed in on it, according to the Senate aides. A Cantwell spokesperson declined to comment.
Wicker is now working with Cantwell—who has said she never formally joined the earlier working group—to develop another proposal, according to three sources briefed on the effort. But they haven’t been able to agree on whether to include a private right of action or more powers for the FTC or state attorneys general, the sources said.
Cantwell is working on her own framework for a bill that would include a private right of action, new restrictions for online advertising, and expanded rulemaking and fining authority for the FTC, according to five sources familiar with the draft proposal. But Moran, Wicker, and Thune oppose a private right of action provision.
Blumenthal and Moran are developing their own bill to give the FTC more enforcement authority and allow state attorneys general to enforce privacy laws, and also preempt state laws, according to two Senate aides and a policy strategist briefed on the effort. That prospective bill wouldn’t allow consumers to sue companies directly after a privacy incident, the sources said.
House lawmakers are developing bills of their own. California Democrats Anna Eshoo and Zoe Lofgren have a circulated a proposal that would create a new data protection agency and give consumers the right to sue companies for privacy harms.
Rep. Jan Schakowsky (D-Ill.), who chairs the House Energy and Commerce Consumer Protection and Commerce Subcommittee, is likely to unveil a bill in the fall, according to two House aides. The subcommittee’s ranking member, Cathy McMorris-Rodgers (R-Wash.), may support the prospective bill, which currently doesn’t include a private right of action, according to three House committee aides.
Even though no bill is moving in either chamber, proponents are still optimistic that Congress will act.
“This idea that things were going to be easily dealt with in a few months was always probably too ambitious,” Joseph Jerome, privacy and data policy counsel at the Center for Democracy and Technology, said.