A House Democrat is introducing the first comprehensive federal privacy bill of the year after recent state efforts to protect consumer data underscored the need for a broad federal standard.
Legislation unveiled Wednesday by Rep.
DelBene’s Information Transparency and Personal Data Control Act marks Congress’ initial foray into privacy legislation this session, less than two weeks after Virginia joined California in the state-level push to advance broad consumer privacy laws.
At least 15 state legislatures have active privacy bills under consideration, according to data from the International Association of Privacy Professionals. The Senate in DelBene’s home state of Washington advanced a privacy measure last week, the chamber’s third attempt to pass a privacy bill.
“I understand why states are moving forward in the absence of the federal government moving, but I think it is much better to have a federal law versus a patchwork of laws from a consumer standpoint, but also from the standpoint of a small business,” DelBene said in an interview.
DelBene, whose state is home to tech giants
Opportunity for Compromise
The House bill, which updates a version DelBene offered last Congress, would require companies to disclose if personal consumer information is shared. The bill would preempt most, but not all, existing state privacy laws, something Republicans have pushed for in a federal bill.
“I think there is a big opportunity to have it be bipartisan,” she said, although she didn’t name any specific Republican members she’s working with.
The bill has 15 Democratic cosponsors in the House. It has backing of tech policy think tank the Information Technology and Innovation Foundation, as well as BSA|The Software Alliance, whose members include
Other House efforts are expected this year from Rep.
The Senate has yet to introduce any privacy legislation this year. Partisan bills were introduced last Congress by Sen.
Wicker said he hopes the state privacy action “brings members back to the table in the Senate to discuss a path forward for a federal data privacy law.”
Increased FTC Enforcement
DelBene’s measure does not include a private right of action, which would allow consumers to sue companies over privacy violations.
Such provisions have been lightning rods for Republicans, who say that legal fees from privacy lawsuits would put start-ups out of business. Cantwell’s effort last Congress included a private right of action.
DelBene’s updated bill instead would beef up the enforcement at the Federal Trade Commission and in state attorneys general offices. The bill would direct FTC to hire 500 new employees, and would authorize $350 million in appropriations to the FTC for privacy and data security enforcement. The bill would also give FTC narrow rulemaking authority. It would require large companies to undergo third-party privacy audits every two years that would be reviewed by the FTC.
Tech policy and industry groups were largely supportive of the bill, applauding the the extra resources for the FTC.
“This would put the agency where it belongs, at the lead of the global regulatory effort to chart privacy policies and enforce data protection laws,” Omer Tene, vice president of the International Association of Privacy Professionals, said in statement.
NetChoice, whose membership includes
DelBene said she made her legislation more narrowly focused than Europe’s General Data Protection Regulation (GDPR). “I purposely wanted to focus just on the consumer data privacy side just so we could get that through and be foundational,” she said.
“I’m hopeful we can make it happen this Congress,” she said. If not, she added, more states will enact laws and could make a federal law even more challenging to pass.