Despite facing a time crunch, a flood of stakeholder feedback and unforeseen Congressional opposition, the proposed American Data Privacy and Protection Act keeps on chugging.
The bill's next act will come on the U.S. House floor after the House Committee on Energy and Commerce markup July 20 resulted in a 53-2 vote to advance the bill to full House consideration. The vote to advance marks the first time a comprehensive privacy bill will be made available for a full chamber vote in either the House or the Senate.
"We have finally come up with a landmark compromise, the key word being compromise," Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce Chair Rep. Jan Schakowsky, D-Ill., said. "It's been a lot of work bringing these stakeholders together. I know almost everyone can probably find something that they wished were different in the bill. On the other hand, I do think we have a band-aid for the American people who are just fed up with the lack of privacy online."
The majority of the updates included in the amended bill passed out of committee came via an amendment in the nature of a substitute submitted by Energy & Commerce Committee Chair Rep. Frank Pallone, D-N.J. Important changes made by the AINS included changing the private right of action's effective date from four years to two years post-adoption, expanding categories of sensitive information, enforcement tweaks related to the authority of the U.S. Federal Trade Commission and the California Privacy Protection Agency, updated language on the "actual knowledge" standards around minors' data, and technical changes to the definitions for "covered entity" and "service provider."
"There's been a lot of work done to get to this place," Committee on Energy and Commerce Ranking Member Rep. Cathy McMorris Rodgers, R-Wash., said. "There's been a lot of ... [c]onstructive feedback necessary to move a bill like his through committee. … I support the AINS as it reflects a bipartisan agreement to continue to improve this solution as it goes through the legislative process."
California chaos
While other amendments were accepted during the markup, an attempt to exempt the California Consumer Privacy Act and the California Privacy Rights Act from the bill's preemption provisions was not taken up following a 48-8 roll call vote. There was foreshadowing for this amendment, raised by Rep. Anna Eshoo, D-Calif., a week before the markup when reported concerns from Californian members of the House surfaced over how California's privacy law is perceived to be stronger than the current federal proposal.
The argument was framed differently by Eshoo when she brought the amendment to the committee, calling for a "federal floor" for all states to build off and not a specific carveout for California.
"It allows all states, not just California, to provide additional rights in addition to those established under federal law," Eshoo said. "The ADPPA provides strong privacy protections, particularly in regards to civil rights and child safety. … This amendment would not affect those rights and protections, it would simply let states strengthen them."
Eshoo also spoke to the need for "flexibility to respond to changes in technology and expand rights where necessary" while noting Congress "has not demonstrated" the ability to do so in a timely manner. Meanwhile, Rep. Doris Matsui, D-Calif., took a more blunt approach to her dissatisfaction with preempting California while also noting support for for dialed back preemption from Gov. Gavin Newsom, D-Calif., Speaker of the State Assembly Anthony Rendon, D-Calif., and the California Privacy Protection Agency.
"Since the start of these discussions one thing has been clear: The California delegation is committed to protecting our state's progress and its ability to lead," Matsui said. "I believe the ability to continue to raise the bar on privacy is vital for California and the nation. Unfortunately as drafted, this bill does not preserve that ability. By foreclosing California's ability to act, I believe we are doing my state and the country a profound disservice. … California must remain a voice for consumers everywhere."
The supporting remarks were met with bipartisan backlash, as most committee members viewed Eshoo's amendment as effectively unraveling the fragile compromise Congress had worked toward over recent months and years. Rep. Billy Long, R-Mo., posed the question, "why are we even here or why are we doing this if we're going to preserve California?" Committee Chair Pallone was equally sour on risking the fate of the bill over California's perceived strength while opining that "no state has a law as strong" as the current federal proposal.
"It's no secret that preemption of state laws has long been a key sticking point when you're trying to deal with compromise," Pallone said. "There are areas, not too many in my opinion, where the California law is stronger and we have made an exception. But basically this amendment would reject all the efforts to come to a compromise by replacing carefully crafted preemption provisions, mindful of some of the states, with a provision that will not set a true federal standard."
The committee risks losing supporters if the the exclusion of California laws from preemption is not added or sorted by the time a floor vote arrives, according to Matsui, who voted yes to advance the bill out of committee "for more discussion because we aren't there yet." The six committee members from California supported Eshoo's amendment, but comments from some of those members during the markup put into question whether all six would turn their backs on the proposal and encourage others to join during a House floor vote.
"This is a bill that's long overdue and badly needed," Rep. Jerry McNerney, D-Calif., said. "If we don't pass it now then I don't think we're going to have a chance to pass this for a good long time again. I urge the committee to pass this."
Victory march
The back-and-forth around preemption was the only contentious stretch during the session. Issues raised during the previous subcommittee markup, including children's privacy enhancements and further PRA refinement, were presumably resolved since there was no mention in the latest markup.
Seven bipartisan amendments were adopted without objection, including provisions for authorizing the FTC to regulate security requirements with U.S. National Institute of Standards and Technology consultation, an exemption for data sharing in the context of health research, and an exemption to the data privacy officer requirement for small and medium-sized businesses with fewer than 15 employees. Three partisan amendments besides Eshoo's were offered and immediately withdrawn to avoid hamstringing the committee vote on the full bill while ensuring post-committee discussions would be had.
Committee members' comments throughout the session depicted a genuinely content and united stance regarding the bill's current standing and how far bipartisanship has gotten them.
Committee on Energy and Commerce Subcommittee on Consumer Protection and Commerce Ranking Member Rep. Gus Bilirakis, R-Fla., touted the fact that "all the members have had an opportunity to give their input" and each of those contributions have "made the bill better." Rep. Debbie Dingell, D-Mich., echoed sentiments from Schakowsky in a prior hearing about how Congress "will not let perfect get in the way of the good" with federal privacy legislation and "the absence of action is not an option."
It's unclear when the bill will have its number called on the House floor. In addition to ongoing negotiations regarding preemption and other raised issues that need to be ironed out before a vote, time is short with an August recess and a focus shift to midterm elections looming. What is clear is that House leaders and those lawmakers dedicating time to the proposal do not want to see the clock run out.
"Today’s markup is another milestone towards our ultimate goal of enacting meaningful national privacy legislation," Pallone said. "This legislation is our best hope at protecting Americans privacy and data security, while also providing certainty to American businesses."
