There might not be a lot of clamoring for or momentum toward U.S. privacy legislation as of recent weeks, given competing priorities, but that's not to say it isn't still a necessity. That's what some of privacy's influential figures discussed Wednesday during the Brookings Institution's Center for Technology Innovation's webinar on potential solutions for bridging the gaps that exist in the federal privacy law debate.
"The need for federal privacy legislation is greater now than it has been before," Federal Trade Commissioner Christine Wilson said. "There's a consensus from stakeholders that it's a good and necessary thing. But the pandemic has laid bare, in very stark ways, the lack of federal privacy legislation we have in the U.S. today.
"We have new, complex and sticky questions about location and health data. ... If we had federal privacy legislation in place previously, it could've provided useful guardrails for addressing these issues."
The discussion was timed with the release of Brookings' report on recommendations for how Congress could go about crafting a federal law. Brookings Tisch Distinguished Visiting Fellow Cameron Kerry, a co-author of the report, moderated the panel featuring Wilson, Microsoft Chief Privacy Officer Julie Brill, and Public Knowledge President and CEO Chris Lewis.
Kerry's report recommends a federal law with a nuanced take on federal preemption, a private right of action, and duties of loyalty and care.
Brill pointed to the increased use of personal data related to COVID-19 mitigation technologies, noting companies deploying such tools could have used legislation to help establish user trust, which would, in turn, ensure those technologies were adopted.
"People need to know the data that is going to be used will only be used only for public health purposes," Brill said, noting a purpose limitation principle will be key to ensure data "will not start to be used by government, law enforcement, people who are trying to figure out who's at protests and (for) other reasons."
More generally, Lewis said trust is key to moving Congressional talks on privacy forward. He called the FTC's prior work to further privacy "admirable" but "limited by the rules and the powers of the FTC to really engender trust from the public." However, the tides may have turned with concerns over government powers in the last year.
"The proposals coming out now over the last several months and this effort you've put together, Cam, are really about raising the standards," Lewis said. "It's raising the authority and the power of the federal government, at the (FTC) or elsewhere, to make sure we can keep up with the pace of technology changes as it moves into different parts of our lives."
The panel also discussed prior efforts to pass state privacy laws, particularly focusing on how close the Washington Privacy Act came to crossing the finish line in March. Brill, on behalf of Microsoft, was heavily involved in WaPA's drafting and debates on its provisions. Despite its failure, Brill said there were important takeaways for future drafting efforts, including some consensus on consumer empowerment, transparency, accountability and strong enforcement.
"There's lots of room to talk about what it means to have strong enforcement and to ensure people can effectuate their rights," Brill said. "I think most everybody agreed consumers need some form of redress. ... There was a lot of conversation about how we could get to a place where all stakeholders felt comfortable. Frankly, I think if we had another month we would've gotten there."
Wilson said she remains optimistic that a federal law is on the horizon in the near term based on businesses' and consumers' desire for clarity on the rules. Wilson said the only way to achieve that is a single law rather than a patchwork across states.
"It is very difficult for businesses to invest and innovate without predictability and certainty, and it's important for consumers to understand how their information is collected and used," Wilson said. "If there are 50 state laws because nature abhors a vacuum and Congress doesn't give us federal privacy legislation, that's a lot of confusion for consumers. I just think we shouldn't let the perfect be the enemy of the good."