The chairs of the House and Senate Commerce committees unveiled a discussion draft of a long-awaited bipartisan data privacy bill Sunday evening.
Efforts to pass a comprehensive data privacy bill have failed in Congress for years, leaving the U.S. behind on protections as global regulators push ahead and state laws try to fill the gaps, creating a patchwork of regulations for tech companies to follow.
Seizing on attention to the issue from mounting concerns about the rise of artificial intelligence (AI) and social media platforms’ harms to children, the draft legislation released by House Energy and Commerce Chair Cathy McMorris Rodgers (R-Wash.) and Senate Commerce Committee Chair Maria Cantwell (D-Wash.) seeks to strike a balance to meet the sticking points both sides of the aisle raised in previous debates around data privacy proposals.
“A federal data privacy law must do two things: it must make privacy a consumer right, and it must give consumers the ability to enforce that right,” Cantwell said in a statement. “Working in partnership with Representative McMorris Rodgers, our bill does just that. This bipartisan agreement is the protections Americans deserve in the Information Age.”
McMorris Rodgers said the bill is the “best opportunity we’ve had in decades to establish a national data privacy and security standard that gives people the right to control their personal information.”
Here’s are five things to know about the discussion draft of the American Privacy Rights Act of 2024.
Giving people more control over their data
The draft bill lays out requirements that aim to require companies to be more transparent about how they use consumer data and give consumers more rights over how their data is used.
One key requirement is that the bill would require companies to let users opt out of targeted advertising and data transfers.
Companies covered by the legislation would also be required to make their privacy policies publicly available and disclose details, such as the categories of data collected, processed or retained and the purposes for the data processing.
When material changes are made to the policy, the company must provide advance notice and the means to opt out of the process or transfer or previously collected data.
The bill preempts state laws
A crucial component of the proposal is that it would preempt state law, meaning it would apply in place regardless of rules states have set forth.
Preemption was a key sticking point over a previous data privacy bill, the American Data Privacy and Protection Act, that advanced out of the House Energy and Commerce Committee nearly two years ago. Republicans pushed for preemption, but some California Democrats raised concerns about how it would undermine the state’s protections.
Reps. Anna Eshoo (D-Calif.) and Nanette Díaz Barragán (D-Calif.) were the only members to vote against advancing the bill at the time.
To mitigate those concerns, the draft of the American Privacy Rights Act of 2024 aims to be stronger than the California state laws, according to committee aides.
Consumers could seek financial damages under the bill
Part of the balance the bill seeks to strike is allowing for the preemption, which Republicans had been pushing for, while allowing for consumers to seek financial damages, a point Democrats had sought.
In the new law, consumers may file private lawsuits against entities that violate their rights under the new rules.
That ability would go into effect as soon as the law does. The previous House bill that advanced faced pushback from Cantwell over a two-year delay in enforcement of consumers’ private right of action.
It has bipartisan, bicameral support
The unveiling of the bill with support from McMorris Rodgers and Cantwell is crucial because it highlights bipartisan support for the effort and support from the chairs of both chambers.
The American Data Privacy Protection Act had bipartisan support, with both the chair and ranking member of the House Energy and Commerce Committee behind it. But the measure failed to get bipartisan support in the Senate, where Cantwell’s opposition stalled the bill.
The support from both committee chairs gives the American Privacy Rights Act of 2024 a better chance of moving forward and being brought up for a markup in the committees.
At the same time, Congress is also facing pressure to act on other tech issues, including a bill that could lead to a ban on TikTok. The Protecting Americans From Foreign Adversary Controlled Applications Act passed in the House in a broad bipartisan vote after quickly moving through the chamber, putting pressure on the Senate to act.
That bill would force TikTok’s Chinese parent company ByteDance to sell the app or face a ban in the U.S. over national security concerns.
Committee aides stressed that the two bills are separate and on their own paths.
With the election approaching, though, the deadline for Congress to act on any legislation is dwindling.
Discussion draft suggests input, changes from committees
The legislation is a discussion draft at the moment, indicating the committee chairs are open to potential changes from discussion from other members.
House Energy and Commerce Committee ranking member Frank Pallone Jr. (D-N.J.) in a statement said the bill is a “very strong discussion draft,” but it could be stronger in certain areas, such as children’s privacy.
“I’ve long said that you cannot meaningfully address comprehensive privacy reform without including heightened protections for our nation’s young people,” Pallone said.
“The Energy and Commerce Committee has a proven track record of getting hard things done. I’m optimistic that we’ll be able to build on that record as Chair Rodgers and I work together to get comprehensive privacy legislation across the finish line,” he added.
“A committee aide said the bill is not meant to supplant bills related to kids’ privacy or kids safety online, another issue on which Congress has faced pressure to act.