Cybersecurity Policy Report, Rodgers, Cantwell Unveil Draft Data Privacy Bill, (Apr 8, 2024)

By Lynn Stanton

House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R., Wash.) and Senate Commerce, Science, and Transportation Committee Chair Maria Cantwell (D., Wash.) yesterday unveiled a discussion draft of comprehensive data privacy legislation that would give consumers control over their data and opt-out rights with respect to its collection and use; impose data minimization and data security requirements; crack down on the use of algorithms in collecting and using personal data and the use of “dark patterns” to subvert individual decision-making online; and preempt state privacy laws, while preserving general consumer protection laws, civil rights laws, and privacy laws aimed at employee and student information, along with a number of other enumerated state laws in areas such as medical and financial information, library records, electronic surveillance, and data security.

The draft American Privacy Rights Act would also require affirmative consent for the transfer of sensitive data — such as government-issued identification numbers, biometric data, precise geolocation information, health- and financial-related data, the content of private communications, images that show “the naked or undergarment-clad private area of an individual,” information about an individual’s online or video viewing history, information “revealing an individual’s race, ethnicity, national origin, religion, or sex in a manner inconsistent with the individual’s reasonable expectation regarding disclosure,” and any information about a minor. If such a transfer is for a specific purpose for which the individual already gave affirmative consent, additional consent would not be required.

It would impose data security mandates on companies appropriate to their size, to the nature and scope of their data activities, and to the volume and sensitivity of their data. It would require companies to inform individuals if their data is transferred to a foreign adversary, “as determined by the Secretary of Commerce in part 7.4 of title 15, Code of Federal Regulations, or any successor regulation.”

The Federal Trade Commission and state attorneys general could enforce the bill if enacted, and individuals would have a private right of action under the legislation. Companies would be prohibited from enforcing mandatory arbitration clauses with respect to alleged violations of the legislation.

In a joint statement, Chairs Rodgers and Cantwell said, “This bipartisan, bicameral draft legislation is the best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information. This landmark legislation represents the sum of years of good faith efforts in both the House and Senate. It strikes a meaningful balance on issues that are critical to moving comprehensive data privacy legislation through Congress.”

The draft American Privacy Rights Act would apply to common carriers, as well as other entities that are subject to the Federal Trade Commission Act and that collect, process, retain, or transfer data linked or reasonably linkable to an individual or a device.

Individuals would have the right to access their covered data, to have the data holder correct errors, to deleted covered data, to export their data, to opt out of the transfer of non-sensitive covered data, and to opt out of the use of their personal information for targeted advertising. The FTC would be authorized to adopt rules to “establish the requirements and technical specifications for a centralized mechanism for individuals to exercise the opt-out rights,” according to a “section-by-section” description of the 53-page draft bill.

The bill would prohibit the use of dark patterns to distract users from the notice of their rights, to impair the exercise of rights, or to obtain consent. “Covered entities may not retaliate against individuals for exercising their rights under the Act, including by denying or charging different rates for goods or services,” the section-by-section summary says.

The draft bill would not apply at all to small business — those with $40 million or less in annual revenue, collecting, processing, retaining, or transferring the covered data of 200,000 or fewer individuals, and not earning revenue from the transfer of covered data to third parties.

The draft bill would impose additional obligations on large data holders, defined as having $250 million or more in annual revenue, collecting, processing, retaining, or transferring the covered data of more than 5 million individuals or 15 million portable devices or 35 million connected devices that are linkable to an individual.

While all covered data holders would be required to have publicly available privacy policies that explain how consumers can exercise their data-control and opt-out rights, large data holders would have to retain and publish their privacy policies from the past 10 years and also provide a short-form notice of their policies, the section-by-section summary said.

All covered entities “must comply with individual control rights within specified timeframes, and large data holders must report metrics related to the requests they process,” the section-by-section summary says.

Large data holders also would have additional obligations in the area of executive responsibility. “All covered entities must designate one or more covered employees to serve as privacy or data security officers,” while large data holders would have to “designate both a privacy and a data security officer”; “file with the FTC annual certifications of internal controls designed to comply with the Act and internal reporting structures for compliance with the Act”; and “conduct privacy impact assessments on a biennial basis,” the section-by-section summary says.

The draft bill would prohibit the collection, processing, retaining, or transferring of data in a way that discriminates on the basis of race, color, religion, national origin, sex, or disability, with exceptions allowed “for the purposes of self-testing to prevent unlawful discrimination, diversifying an applicant or customer pool, or advertising economic opportunities or benefits to underrepresented populations,” the summary says.

Large data holders that use algorithms must conduct impact assessments detailing the data used both as inputs and for training and explaining the steps taken to mitigate potential harm to minors; to those seeking or using housing, education, employment, health care, insurance, or credit opportunities; to those seeking access to public accommodations, “particularly as such harms relate to the protected characteristics of individuals, including race, color, religion, national origin, sex, or disability”; or to anyone based on their race, color, religion, national origin, sex, disability status, or political party registration status.

The bill would require data brokers to maintain websites identifying themselves as data brokers, would bar them from “advertising data for the purpose of stalking or fraudulent purposes” and from “misrepresenting their business practices”; and would require data brokers “affecting the data of 5,000 or more individuals” to register each calendar year.

The bill would not change obligations under the Childrens Online Privacy Protection Act.

It would terminate the FTC’s ongoing rulemaking proceeding on commercial surveillance and data security.

In a statement, House Commerce Committee ranking member Frank Pallone Jr. (D., N.J.) said, “This is a very strong discussion draft, built on the foundation of years of hard work by the Energy and Commerce Committee to strengthen our nation’s data privacy laws. Forging bipartisan, bicameral consensus on major legislation is incredibly difficult, especially in this current congressional environment, and I’m grateful to Chair Rodgers for her leadership advancing E&C’s priorities in this draft legislation.”

He added, “There are some key areas where I think we can strengthen the bill, especially children’s privacy. I’ve long said that you cannot meaningfully address comprehensive privacy reform without including heightened protections for our nation’s young people.”

Information Technology Industry Council President and Chief Executive Officer Jason Oxman said, “The technology sector shares Chairwoman Cantwell and Chairwoman McMorris Rodger’s goal of enacting comprehensive federal privacy legislation, which is essential for continued U.S. economic competitiveness. ITI has long called for a privacy bill that creates a uniform national standard for consumer protection, clearly defined responsibilities for companies that collect and process data, and appropriately tailored enforcement. We appreciate the bipartisan, bicameral leadership advancing the privacy conversation on Capitol Hill and look forward to reviewing the bill and constructively engaging with the U.S. Congress as it moves forward.”

News: FederalLegislation DataPrivacy