The U.S. House Committee on Energy and Commerce is ready to make another run at comprehensive federal privacy legislation with its third different attempt in the last three congressional terms. The latest effort involves a new committee working group and a request for information that will lend fresh perspective to a new proposal that is likely to abandon aspects of bipartisan and bicameral progress made on prior proposals for the American Privacy Rights Act and the American Data Privacy and Protection Act.
New Energy and Commerce Chair Brett Guthrie, R-Ky., indicated in December the committee would "prefer to do a comprehensive privacy bill," while at least planning to focus on finalizing children's online safety if a comprehensive bill didn't materialize. Recent actions from Guthrie align with his initial aspirations.
On 12 Feb., Guthrie launched a nine-member Republican working group he said would explore options for a comprehensive framework "that can get across the finish line." The next shoe to drop in committee explorations came a week later with the new RFI seeking stakeholder engagement on six specific prompts that will guide the working group and the broader committee's discussions toward a bill.
The RFI acknowledges Congress has "spent many years" negotiating a bill that will "bring consumer protections into the digital age while ensuring that the U.S. continues to lead in a globally competitive environment." It also discusses the reality of the delicate balance lawmakers have been tasked with striking with any legislation.
"The challenge of providing clear digital protections for Americans is compounded by the fast pace of technological advancement and the complex web of state and federal data privacy and security laws, which in some cases create conflicting legal requirements," the RFI states.
RFI goals
Junior committee members, especially first-year members, are set to benefit most from the RFI, but the prompts do raise pertinent questions the committee has wrestled with in the past and will ultimately need to revisit.
Debates over scope and definitions have long plagued lawmakers' ability to find consensus. The RFI asks for details on whether a potential law should "take into consideration an entity’s size, and any accompanying protections, exclusions, or obligations." It also inquires about what should be included in definitions for personal information and sensitive personal information.
A prickly point in prior privacy negotiations was the structure of federal preemption of comprehensive state privacy laws, which Republican committee strongly supported. The RFI takes aim at the preemption conversation again with a whole section of prompts dedicated to "existing privacy frameworks (and) protections." One prompt aims to tackle the financial burden of the state patchwork, asking for details on "the degree to which U.S. privacy protections are fragmented at the state-level and the costs associated with fragmentation."
The RFI also loops artificial intelligence into the conversation. An Energy and Commerce subcommittee dove into the interplay between AI and privacy in October 2023, which resulted in a resounding theme that a federal privacy law needed to come before AI regulation. The RFI indicates state-level legislation around automated decision-making technology and raises questions that need to be answered regarding "the role of privacy and consumer protection standards in AI regulation and the impact on U.S. AI leadership."
National Advertising Initiative Vide President of Public Policy David LeDuc, CIPP/US, told the IAPP the RFI "provides a thoughtful, holistic approach, recognizing that privacy and data-driven innovation are not mutually exclusive."
Inclusive process
Guthrie's current approach has peaks and valleys compared to those of his predecessors.
On the one hand, stakeholder engagement in the pre-drafting stage of committee discussions is a positive change among stakeholders. Notably, the process carried out on the proposed APRA in the 118th Congress was more closed-door, with former House Energy and Commerce Chair Cathy McMorris Rodgers and Sen. Maria Cantwell, D-Wash., previously chair of the Senate Committee on Commerce, Science and Transportation, being selective with their public engagement.
NAI's LeDuc characterized the prior negotiations and drafting as "clandestine," noting Guthrie's process "is a very welcome shift." Center for Democracy and Technology Director Privacy and Data Project co-Director Eric Null told the IAPP he's pleased to see the committee taking comprehensive privacy "seriously" and hopeful it "prioritizes areas of bipartisan agreement."
The lack of bipartisanship this time around will be a steep climb for Guthrie, even with the House Republican majority working to his favor. The ADPPA and APRA each garnered degrees of support across the aisle in both chambers.
It's unclear if Guthrie gauged Democrat interest in joining this fresh initiative, but the optics create different questions around the strength of a potential framework.
"Given the history of privacy in this committee, I am disappointed to see that this working group is partisan," Null said. "It does not include Republican privacy leaders on committee like (Rep. Gus Bilirakis. R-Fla.,), and seems disconnected from the extensive bipartisan work done by the committee just last year and in 2022."
Joe Duball is the news editor for the IAPP.
