Dem pulls cyber add-on allowing Europeans to sue over personal data

Sen. Chris Murphy (D-Conn.) is no longer putting forward an amendment to a contentious cybersecurity bill that tacked on a piece of privacy legislation he is attempting to speed through the Senate.

The so-called Judicial Redress Act would give European citizens the right to sue in U.S. courts if their personal data is mishandled. Passage is a prerequisite to a pending data-sharing agreement between the U.S. and the EU.

{mosads}The House passed its version of the bill earlier this week.

The amendment was shelved, for now, over concerns that it wouldn’t be considered germane and therefore wouldn’t get a vote under Senate rules. But the bill is seen as largely uncontroversial and is expected to move forward without much opposition.

Murphy and co-sponsor Sen. Orrin Hatch (R-Utah) said they would continue to pursue passage of the Judicial Redress Act through other avenues.

“We’re going to chat with the leader and see what’s the best thing to do, but we need to get that passed,” Hatch told The Hill. “I would think it would have pretty strong bipartisan support.”

Debate over a slate of amendments has dominated floor time as the architects of various proposals work to balance the concerns of privacy advocates with demand for action on some kind of cyber legislation.

The underlying bill, called the Cybersecurity Information Sharing Act (CISA), would give legal liability to companies that share digital threat data with the government. It has been repeatedly stymied by concerns that it undermines consumer privacy and weakens online security overall.

Various lawmakers have tried to mitigate those concerns — and advance their own agendas — resulting in a list of 22 amendments that leadership agreed before the August recess would see debate.

In an attempt to smooth passage of the bill, co-sponsors Sens. Dianne Feinstein (D-Calif.) and Richard Burr (R-N.C.) negotiated a package of alterations that combined six edits from the two senators and portions of 14 amendments from other lawmakers that have been tacked on since August.

“It makes important changes to the bill,” Feinstein said on the floor Wednesday, “to address privacy concerns about the legislation.”

The Senate voted Thursday to end debate on the package. Under Senate rules, in order for an amendment to be considered after cloture has been invoked, it has to be considered germane by the Senate parliamentarian.

Some lawmakers, including Sens. Dean Heller (R-N.V.) and Sheldon Whitehouse (D-R.I.), have expressed frustration at how the proceedings have affected their additions.

“For some reason, the masters of the universe have gone off and had a meeting and decided that this [amendment] was not going to be in the queue,” Whitehouse said in a heated floor speech on Wednesday.

Whitehouse’s amendment did not make the cut to be included in the manager’s amendment package and is considered nongermane, meaning it is now extremely unlikely to get a vote.

His amendment would expand the penalties that prosecutors can seek for violations of the Computer Fraud and Abuse Act (CFAA), which prohibits accessing protected networks.

Heller’s amendment, which would require companies to remove personal information shared from cyberthreat data if they “reasonably believe” the information isn’t directly related to a threat, was not included in the manager’s amendment package but will still receive a vote.

“We tried to get everything into the manager’s amendment that we possibly could,” Burr said on the floor Thursday.

The Senate voted Thursday to strike down a contentious proposal from Sen. Rand Paul (R-Ky.) that CISA backers said could have killed the whole measure.

Paul’s amendment would have stripped liability immunity from any company found breaking a user or privacy agreement with its customers. The offering received 32 votes, short of the simple majority needed to pass.

This story was upated at 4:19 p..m. Cory Bennett contributed.