Congress may be closer than ever to adopting a comprehensive privacy framework after key committee chairs in the House and Senate released a new proposal on Sunday.
The bipartisan proposal, called the American Privacy Rights Act (APRA), would limit the types of consumer data companies can collect, store and use, allowing only what they need to operate their services. Users would also have the option to unsubscribe from targeted advertising and would have the opportunity to view, correct, delete and download their data from online services. The proposal would also create a national registry of data brokers and force these companies to give users the opportunity to opt out of the sale of their data.
“This groundbreaking legislation gives Americans the right to control where their information goes and who can sell it,” House Energy and Commerce Committee Chairwoman Cathy McMorris Rodgers said in a statement Sunday. “It reins in Big Tech by prohibiting them from tracking, predicting, and manipulating people’s behavior for profit without their knowledge or consent. The vast majority of Americans want these rights and expect us, their elected representatives, to act.”
Congress has been trying for decades to craft a comprehensive federal law to protect user data. But lawmakers remain divided over whether this legislation should prevent states from adopting stricter rules and whether to allow a “private right of action” that would allow people to sue companies in response to data breaches.
In an interview with The Speaker Review On Sunday, McMorris Rodgers claimed that the draft’s language was stronger than any active legislation, apparently in an attempt to assuage the concerns of Democrats who have long resisted attempts to circumvent existing protections at the state level. APRA allows states, among other things, to enact their own data protection laws related to civil rights and consumer protection.
In the previous session of Congress, the chairmen of the House Energy and Commerce Committees negotiated an agreement with Roger Wicker, the top Republican on the Senate Commerce Committee, on a bill that would preempt state laws except for the California Consumer Privacy Act and the Biometric Illinois Information Privacy Act. That measure, called the American Data Privacy and Protection Act, also created a weaker private right of action than most Democrats were willing to support. Senate Commerce Committee Chairwoman Maria Cantwell declined to support the measure and instead circulated her own bill. The ADPPA was not reintroduced, but APRA was designed as a compromise.
“I think we’ve reached a very important point here,” Cantwell said The Speaker Review. “We maintain the standards that California, Illinois and Washington have.”
APRA incorporates language from California’s landmark privacy law that allows people to sue companies if they suffer harm from a data breach. It also gives the Federal Trade Commission, state attorneys general and private citizens the power to sue companies if they violate the law.
Categories of data that would be affected by APRA include certain categories of “information that identifies, is associated with, or may reasonably be associated with, an individual or device,” according to a Senate Commerce Committee summary of the legislation. Small businesses – those with annual revenue of $40 million or less and limited data collection – would be exempt under APRA, with enforcement focused on businesses with annual revenue of $250 million or more. Governments and “entities working on behalf of governments” are excluded from the bill, as are the National Center for Missing and Exploited Children and, apart from certain cybersecurity provisions, nonprofit organizations that “fight fraud.”
Frank Pallone, the top Democrat on the House Energy and Commerce Committee, called the bill “very strong” in a Sunday statement but said he wanted to “strengthen” it with stronger child safety provisions.
However, it remains unclear whether APRA will receive the necessary support for approval. On Sunday, committee staff said discussions were still ongoing about other lawmakers signing the bill. The current proposal is a “discussion draft”; Although there is no official date for submitting a bill, Cantwell and McMorris Rodgers will likely review the text with colleagues for feedback in the coming weeks and plan to send it to committees this month.