Senators inch forward on federal privacy bill

Senators argued for their dueling proposals for a federal privacy law during a highly anticipated hearing on Wednesday, marking the first time key Republicans and Democrats have taken their disputes public after months of closed-doors negotiations.

The Senate Commerce Committee hearing underlined the significant daylight between the parties over how Congress should approach the country’s first comprehensive privacy bill, which will create new safeguards around how businesses collect personal information about Americans — once lawmakers are able to resolve their long-standing disagreements. 

“It is my hope that we can ultimately work together on a bipartisan basis to produce legislation that puts consumers’ interests first while still allowing the private sector to innovate and grow,” said Sen. John Thune (R-S.D.), who has been involved in the committee’s bipartisan negotiations around a potential bill, during the hearing. “Only a bipartisan proposal has the chance of clearing the Senate and becoming law.” 

The hearing came about a week after Senate Commerce Committee Chairman Roger Wicker (R-Miss.) and ranking member Maria Cantwell (D-Wash.) dropped opposing partisan privacy bills, revealing the parties still have not been able to resolve two key issues: whether any federal legislation should empower individuals to sue companies that violate their privacy and whether it should override incoming state privacy laws. 

Wicker acknowledged there are “unresolved issues between my draft and the ranking member’s draft.”

Democrats on Wednesday argued that enabling Americans to sue companies like Facebook or Google would add an extra layer of protection for people whose personal information has been stolen or misused by private companies. 

“If your privacy rights are violated … you need to have the power to do something about it,” Cantwell said. 

Republicans, backing the tech industry’s position, said that it would result in frivolous and costly lawsuits. 

Sen. Dan Sullivan (R-Alaska) said he is concerned that allowing individuals to sue companies, a provision called the private right of action, could “stifle the next innovative American company,” touting the common industry argument that small companies cannot afford to handle a barrage of lawsuits.

But in recent days, top Republicans and Democrats on the committee — including Wicker — have signaled a willingness to settle on a pared-down private right of action. Sen. Richard Blumenthal (D-Conn.) asked the panel of tech representatives and privacy groups whether they would get behind a law that allows injunctive relief, a remedy that would allow courts to order a company to stop a specific behavior, but not collect money. A Microsoft executive on the panel, Julie Brill, expressed openness to that idea.

“A revisit on the private right of action is something that needs to be done,” Sen. Marsha Blackburn (R-Tenn.) told reporters later.

“There was a difference of opinion on that,” she acknowledged, but noted she wouldn’t characterize the dispute as “insurmountable.”  

The Republicans on the panel also emphasized that they believe any legislation should override state laws, including the incoming California privacy law, which set off a wave of lobbying by tech companies calling for one standard federal privacy law. The tech industry has claimed that it would be too costly and confusing to adhere to different privacy laws in every state, seeking to head off incoming proposals in a number of states. 

Sen. Jerry Moran (R-Kan.) said he hopes any bill will “preempt a patchwork of state laws” — which Cantwell’s bill does not. 

Over the past two years, lawmakers across the political spectrum and a range of committees have offered their own privacy proposals and bills, seeking to rein in the enormous power of a tech industry that has been allowed to amass and monetize unprecedented amounts of data about their billions of users. But none of those proposals — including from many members of the Senate Commerce Committee, which oversees tech issues in the upper chamber — have gained significant traction or seen a vote.

“We have a lot of bills, but we have no federal law,” Blumenthal, a tech critic who has engaged in bipartisan negotiations with other members of the committee, said. “I want a law.” 

Nearly every member of the committee touted their own separate privacy or tech-related proposals, previewing the slew of pet issues that senators will likely attempt to tuck into any final privacy bill.

Thune asked the witnesses about his Filter Bubble Transparency Act, which would allow internet users to see content that has not been “curated as a result of a secret algorithm.” Sen. Deb Fisher (R-Neb.) asked if her bill banning deceptive practices by large tech companies should be “part of” any federal privacy legislation. Blackburn pointed out that much of the language in both Wicker’s and Cantwell’s bills parallels provisions in her privacy bill, the Browser Act, which she introduced earlier this year.

But the negotiations between Cantwell and Wicker, which began over the summer and have yet to yield any public bipartisan draft, are the most important because they are the top Republican and Democrat on the key Senate committee. Any legislation jointly from their offices would mark a significant step towards creating a final privacy law — though it would likely endure complicated negotiations with the House. 

Blumenthal told reporters this week that he is continuing to negotiate directly with Moran on a bipartisan bill separate from Cantwell and Wicker’s efforts. But, he noted, after they reach consensus, they will seek to achieve “as broad support as possible.” He declined to say whether he will specifically look for Wicker and Cantwell’s blessing. 

The senators on the committee agreed that any privacy legislation will likely include some basic elements: It will allow users to see, change and delete their own data. It will require companies to clarify and clearly communicate their privacy policies. And it will likely give the Federal Trade Commission more resources to go after tech companies for privacy violations, though the parties largely disagree on how much more power to give the agency. 

Meanwhile, the tech industry is continuing to push for a federal privacy law as soon as possible. Many companies had originally lobbied for Congress to implement a national standard before California’s goes into effect in January, but experts largely agree that timeline is likely no longer feasible.

“Today’s hearing at the Senate Commerce Committee made it absolutely clear that there remains an extremely strong and bipartisan desire in Congress for federal privacy legislation,” Privacy for America, a group representing the online advertising industry, said in a statement on Wednesday. “We heard calls — from both lawmakers and witnesses — for a privacy framework that shifts the burden away from consumers and clearly bars companies from engaging in harmful data practices.

“With comprehensive privacy bills now out from both the Chairman and Ranking Member, we look forward to working with both sides over the coming months to forge bipartisan consensus legislation that provides a strong federal standard protecting all Americans,” the group added.