A House panel advanced a comprehensive data privacy bill in a 53-2 bipartisan vote Wednesday, pushing forward legislation that aims to set a national standard for how tech companies collect and use Americans’ data.
The House Energy and Commerce Committee vote on the American Data Privacy and Protection Act (ADPPA) is a significant step forward after years of delay in lawmakers taking action on a federal data privacy law, but there are still hang ups that could complicate the proposal moving forward.
Several lawmakers from California voiced concerns about how the federal bill could undermine protections from the state’s data privacy law. Reps. Anna Eshoo (D-Calif.) and Nanette Diaz Barragán (D-Calif.) were the only votes against advancing the bill.
Rep. Doris Matsui (D-Calif.) said she would vote to push it forward to continue discussion but would not vote in favor of passing the bill without additional changes.
“I recognize that this law would be an improvement for much of the country, but I can’t say the same for my constituents and all Californians,” Eshoo said.
Eshoo put forward an amendment that would set the federal standard as a floor, allowing states to go beyond the federal regulations. The amendment gained support from her Democratic California colleagues, but it failed to pass at Wednesday’s markup.
Committee Chairman Frank Pallone Jr. (D-N.J.), among the members who voted against the amendment, said the update to set a floor would undermine the compromises made and in turn make the entire bill unable to move forward with bipartisan support.
“But basically what this amendment would do would reject all of the efforts to come to a compromise by replacing carefully crafted preemption provisions, mindful of some of the states, with a provision that would not set a true federal standard,” Pallone said.
California has the strongest data privacy law in the U.S., but other states lack the same protections offered by the Golden State.
The version of the bill considered by the committee was amended before the markup to include updates that grant the California Privacy Protection Agency, created under the state’s privacy law, the express authority to enforce the ADPPA.
The federal proposal aims to create a national standard as opposed to a patchwork of state laws. Republicans have broadly pushed for the federal standard to pre-empt state laws because they said the varying state standards could cause issues for businesses, especially small firms, in complying with different standards.
The bill would give users the ability to sue over violations of the law through a private right of action. The version of the bill the panel voted to advance allows private enforcement beginning two years after the law goes into effect, cutting it down from the four years initially proposed.
The four-year delay was a key target of criticism from Sen. Maria Cantwell (D-Wash.), the chairwoman of the Senate Commerce Committee, when the draft of the bill was first released. Senate Commerce Committee ranking member Roger Wicker (R-Miss.) backs the proposal, but without Cantwell’s support the bill faces little chance of moving forward in the Senate.
The amended proposal that advanced in the House also changed the language around protections for children. The proposal still bans targeted ads to children and treats all information relating to individuals under 17 as sensitive data.
The version of the bill that advanced includes a tiered approach to what constitutes “knowledge” that an individual is under 17, applying different levels to companies of varying sizes.
An amendment to the bill from Reps. Debbie Lesko (R-Ariz.) and Ann Kuster (D-N.H.) was adopted to exclude the National Center for Missing and Exploited Children from being a covered entity to ensure it can collect, process and transfer data to assist in its work on child trafficking, abuse and abduction.