Federal Data Privacy Laws Gain Support in Congress

A drive for the United States' first major data privacy legislation has bipartisan support in the divided Congress ahead of a House committee hearing Thursday, though it faces criticism from businesses and privacy advocates.

The American Privacy Rights Act, cosponsored by Sen. Maria Cantwell, D-Wash., and Rep. Cathy McMorris Rodgers, R-Wash., sets a national data privacy standard that would allow people to request access to and delete their data held by companies, and opt out of targeted advertising. It would also create a national data broker registry.

The U.S. lags other countries and alliances in creating such protections. The European Union's General Data Protection Regulation, which many experts consider the gold standard for data privacy, has been in effect since 2018.

A coalition of industry groups – including the U.S. Chamber of Commerce and TechNet, an advocacy group representing tech CEOs – sent a letter to Rodgers and Cantwell in early June arguing the proposed federal legislation lacks safeguards that would prevent individual U.S. states from adding their own restrictions on top of the national policy.

"The key is to get a single unified national standard without enabling states to regulate on top of the national standard," said Jordan Crenshaw, senior vice president of the U.S. Chamber of Commerce's Technology Engagement Center.

As it stands, "we are seeing deficiencies that would effectively make this bill a national floor," Crenshaw said, upon which states could layer their own data privacy requirements.

Privacy advocates argue the opposite – that the bill would block states from responding to emerging technology.

"Federal legislators are getting pushed to the table because of all this regulation that's happening at the state level," said Mario Trujillo, staff attorney for the Electronic Frontier Foundation, a digital civil liberties nonprofit. "If you take away the state law, in 20 years there's not going to be this groundswell of pressure."

Privacy experts argue that federal pre-emption could negate the "California effect" – a phenomenon where California, the country's biggest state by population, spearheads regulations that are adopted by other states and the federal government over time.

"Setting anything into amber is a net negative for everyone, given the rate at which technology is emerging," Ashkan Soltani, executive director of the California Privacy Protection Agency, said in an interview.

Rep. Suzan DelBene, D-Wash., who represents a state district including parts of Seattle, where Amazon.com and other tech giants have their headquarters, said she supports the bill.

"Right now we have a patchwork of state laws that makes it untenable, especially for small businesses, to be able to keep up," DelBene said.