New federal privacy bill called a ‘consensus’ of existing state laws

After multiple failed attempts, the House is once again trying to pass a national data privacy law, and proponents argue that this one can succeed where the rest have failed.

Rep. John Joyce, a Pennsylvania Republican and the leader of the House Energy and Commerce Committee’s Data Privacy Working Group, introduced the Securing and Establishing Consumer Uniform Rights and Enforcement over Data Act, known as the SECURE Data Act, in April.

Lawmakers and expert witnesses got their first chance this week to debate the new legislation, and many argued that it takes the most positive aspects of the 22 state-level data privacy laws and codifies them into a national standard. States have legislated in the absence of Congressional action with various laws, whether they be comprehensive data privacy laws or focused on narrower issues like data security.

“The SECURE Data Act takes the best ideas of the state privacy laws and incorporates many of the ideas developed over the past several years,” said Rep. Gus Bilirakis, a Florida Republican who chairs the Subcommittee on Commerce, Manufacturing, and Trade, during his opening statement. “It seeks to establish meaningful consumer protections while creating a uniform national standard that promotes innovation, economic growth and regulatory certainty.”

Supporters said the new bill incorporates various positive aspects and requirements from existing state privacy laws, including protecting consumers’ ability to exercise control over their personal data; having heightened safeguards for processing sensitive data; requiring disclosures to consumers; placing restrictions and obligations on service providers; and setting data security requirements.

“Equally important, however, is that these agreed upon privacy protections are effective,” Tyler Bridegan, a partner in the Privacy and Cybersecurity team at the international law firm Womble Bond Dickinson LLP and a former director of privacy and technology enforcement for the Texas Attorney General’s Office, said in written testimony. “When enforced properly, these requirements provide a powerful tool for consumers and government regulators alike.”

Others noted the bipartisan nature of those state-level privacy laws and applauded that the SECURE Data Act uses a similar structure. 

Kate Goodloe, managing director at the Business Software Alliance technology trade group, said it is built on a “core set of rights for consumers,” based on the consensus that they should be able to access, correct, or delete their data, and have the right to opt out of their data’s sale.

Having a strong foundation in state laws that have already passed means this latest effort should be less likely to flounder, she said, as lawmakers in state legislatures have already shown what is possible.

“In the past, efforts to draft comprehensive federal privacy legislation started from a blank slate, without the benefit of a consensus to emerge from the states,” Goodloe said in written testimony. “But the landscape of American consumer privacy laws is no longer blank. Four years ago, when this Committee advanced a comprehensive privacy bill to the full House of Representatives, just one state privacy law was in effect. Today, 22 states have acted. Grounding federal privacy legislation in the structure already widely adopted across the states is a critical step.”

Critics, however, derided this latest piece of legislation, not just for preempting existing state laws but also for the other aspects contained within. They noted its partisan nature, compared to previous bipartisan bills that have been debated in Congress.

Caitriona Fitzgerald, deputy director at the nonprofit Electronic Privacy Information Center, said the bill is “fundamentally flawed” and too weak, as it “sets a weaker standard than the weakest state law as the national ceiling.”

Fitzgerald said the bill puts the onus on individuals to protect their own privacy rather than set any limitations on the companies that collect that data, and strips away key protections that exist in state law, including requirements to honor universal opt-out mechanisms to allow consumers to opt out quickly from targeted advertising and the sale of their personal data. And she said it does not require companies to carry out data protection assessments, nor does it include a private right of action that would help enforce it.

“Rather than advancing consumer rights, its passage would cement weak rules into law, deter stronger future laws, and leave Americans more vulnerable than ever,” Fitzgerald said in written testimony. “Passage of the SECURE Data Act would put many Americans in a worse position than they are in now, making the enactment of this bill worse than no federal privacy law at all.”

Some lawmakers were similarly perturbed. Rep. Frank Pallone, a New Jersey Democrat who is the full committee’s ranking member, said in his opening statement that preempting existing state laws would “eliminate hard won privacy protections that millions of Americans currently enjoy,” and “invalidate any state law that relates to the bill.” And it would mean states would be “forever barred” from addressing future harms.

“[This] bill locks in the failed notice and consent status quo, then compounds loophole upon loophole to water down its provisions,” Pallone said. “And then, to make matters worse, it adds expansive preemption that will leave many Americans with fewer privacy protections than they have today. Rather than taking the strongest consumer protections from the existing state privacy laws, this bill is assembled from industry-friendly state privacy laws that have been pushed by Big Tech. It is, therefore, no surprise that this bill allows Big Tech and others to continue their ongoing privacy violations.”