WASHINGTON — A bipartisan group of House and Senate lawmakers reached an agreement Friday on data privacy legislation, proposing a bill that would allow users to opt out of targeted ads and sue internet companies that sell inappropriately their data.
The legislation, however, faces a steep climb to become law. Lawmakers — Sen. Roger Wicker, R-Miss., and Reps. Frank Pallone Jr., DN.J., and Cathy McMorris Rodgers, R-Wash. — still hope to recruit more supporters, namely Sen. Maria Cantwell, D-Wash., Chair of the Senate Commerce, Science, and Transportation Committee, who has advanced more liberal priorities for online user rights. Without his support, the bill will likely stagnate.
Still, consumer rights advocates say the proposed compromise legislation is the biggest breakthrough yet for efforts to pass a federal privacy law; these efforts have become bogged down in partisan disagreements.
For years, Democrats and Republicans have disagreed about the extent to which federal privacy law should trump state measures, such as the California Consumer Privacy Act, and whether it should give consumers the right to take their own action against offenders.
Republicans support federal preemption of state privacy laws, fearing a patchwork of standards will make compliance difficult for companies, while Democrats have called for a broad private right of action to give consumers legal tools when government enforcement fails.
Legislation unveiled Friday seeks to strike a compromise, including a limit on when and how users can sue internet companies and measures that would replace most national digital privacy laws. Politico first broke the news of the deal.
The bill would require companies to limit their data collection practices to what is specifically necessary to operate their business and would prevent organizations from charging users for access to data privacy measures except in specific circumstances such as such as consumer loyalty programs or the collection of financial data. to complete a transaction.
The Federal Trade Commission would be required to maintain a public registry of data brokers and create a mechanism for users to opt out of targeted advertising and other data sharing practices. Under the legislation, users would have the right to access, correct and delete their digital data, and companies would be responsible for notifying third parties to make changes to user data that they want. Company directors would be required to annually certify that their organizations are in compliance with the law.
To enforce the new requirements, the FTC would create a new office to protect consumer data privacy, and federal regulators and state attorneys general would have the power to sue groups suspected of breaking the law for punitive damages. .
Individuals could also sue companies, but only after a waiting period of four years from the enactment of the law. They are required to notify state and federal authorities before filing a lawsuit and could not proceed with the lawsuit if a government prosecutor took their case.
The bill would also replace most state data privacy laws, except for specific laws on civil rights, student and employee privacy, criminal codes, and financial and medical records.
“This project shows that there is a bipartisan path to long overdue legislation to protect consumer privacy,” said Alexandra Reeve Givens, president and CEO of the Center for Democracy & Technology, a nonprofit technology research group. not-for-profit that receives corporate funds. including Meta, Apple and Google. “Americans desperately want and need legislation to protect their personal data and promote trust in the online world. While not perfect, the draft is a hopeful first step.”
Internet trade association TechNet said the proposal “shows that engines are getting carried away on this issue in a way they haven’t in a long time.”
“While the bill still needs further improvements, it signals that leaders on both sides are committed to action and willing to compromise on key issues such as a private right of action and pre-emption,” Carl Holshouser, the group’s senior vice president, said in a statement. statement. “Further negotiations are needed, but we have more hope than we have in years that a bipartisan privacy bill can make its way to the President’s desk this Congress. “
But major hurdles remain to getting an agreement signed into law.
The bill is already facing headwinds from some prominent Senate Democrats. Sen. Brain Schatz, D-Hawaii, one of the key negotiators in the latest secrecy talks on Capitol Hill, warned panel leaders in a letter Wednesday that their latest effort to pass legislation is “failing” to protect data subjects. consumers. Schatz urged lawmakers to “refuse to settle for a privacy framework that will only result in more policies to read, more cookies to consent to, and no real change for consumers.”
Lawmakers also face an increasingly tight deadline to strike a deal before the midterm elections. Wicker, who led talks for Senate Republicans for years, is widely expected to take over as GOP leader on the Senate Armed Services Committee, which could delay secrecy talks in the Senate committee. of commerce as new leaders enter the scene. Sen. Ted Cruz, R-Tex., a combative tech critic who has focused more on targeting claims of “bias” by social media companies than issues like data privacy, is on the way. to take over from Wicker by seniority.