Microsoft Corporate Vice President Deputy General Counsel Julie Brill said data will play an important role in helping the U.S. respond to and recover from the COVID-19 pandemic. To get the populace to get behind the collection of potentially sensitive data, Brill believes federal rules must help restore a level of faith for those endeavors to succeed.
"It is vital for people to trust how their personal information is used. What was merely urgent when I spoke here 10 months ago is absolutely critical now," Brill said. "Privacy legislation that protects people’s right to own their personal data, that requires companies to collect and use consumers’ data responsibly and that provides enforcement through a strong regulator will build trust and will allow companies to unlock the value of data to solve the most critical problems that we face."
Davis Polk & Wardell Counsel Jon Leibowitz shared a similar sentiment. Leibowitz looked back to when Committee Chair Sen. Roger Wicker, R-Miss., held a hearing to informally discuss the possibility of a federal privacy law two years earlier.
Leibowitz said the participants walked way confident a federal rule would be passed soon. Since the committee is still holding hearings on the same topic, the goal remains unfulfilled, and Leibowitz reflected on what could have been.
"Consumers across the country would be protected by the same consistent privacy regime, regardless of where in the United States they lived, where they work and where they sign on," Leibowitz said. "Our nation’s children, who are taking classes over Zoom and sharing information with their peers on TikTok, would be at less risk from privacy predators, and with clearer rules of the road, Americans would feel more confident about sharing information about contact tracing and more effectively come to together to fight the pandemic."
The COVID-19 pandemic may be another example of why the U.S. needs a federal privacy bill, but there's still plenty to be ironed out before a proposal becomes law. One of these wrinkles is the increased enforcement authority of the Federal Trade Commission.
George Washington University Professor of Global Competition Law and Policy William Kovacic was a former commissioner at the FTC (as were Leibowitz and Brill). When looking over potential options for enforcement, Kovacic told the Senate committee that either a national data protection authority should be established or the FTC should be given greater power.
Kovacic said a national DPA is not a bad idea, as it would symbolize the nation's commitment to federal data protection. In the end, Kovacic believes the FTC's vast experience makes it better suited to take on the enforcement of privacy violations.
"I think it would be very useful to build on that experience to build and implement national policy. I also think there’s a close nexus between privacy and data protection and the other areas of the FTC’s responsibilities, such as antitrust and consumer protection," Kovacic said. "I think not just for privacy and data protection, but the big issues involving big platforms in the future will be solved at the intersection of these policy domains."
The witnesses agreed on giving more enforcement authority and resources to the FTC. The disagreements on any potential privacy law's provisions stemmed from the two points of contention that have been commonly cited as the sticking points between Republicans and Democrats: state preemption and the private right of action.
Baker Botts Partner and former Acting FTC Chairman Maureen Ohlhausen and Leibowitz both support federal rules that are tech neutral and preempt state laws. Both said the "interstate nature" of the internet does not support a patchwork of state laws. Leibowitz said citizens should not live under different privacy laws when moving around the country, while Ohlhausen focused on the impact a patchwork effort has on businesses.
"Although privacy legislation is often justified by concerns about big online players having large amount of consumer information, regulatory complexity actually works in the favor of large well-established companies and hampers smaller entities," Ohlhausen said. "While legislation should provide a national and uniform set of protections and consumer rights throughout our digital economy, preempting state laws should not mean weakening protections for consumers."
California Attorney General Xavier Becerra, whose state now has the strongest privacy law on the books with the California Consumer Privacy Act, disagreed with state preemption. Becerra called state laws the "backbone of consumer privacy" in the U.S. and federal legislation "the glue that ties to our communities together." He added the optimal federal privacy law would recognize that privacy protections must keep up with innovation.
To keep pace with such innovation, the right approach must be flexible enough to adapt to real-world circumstances as they occur. Becerra said this is where states have a distinct advantage over their federal counterparts and urged the committee not to consider state preemption.
"Every day, states tackle these challenges. We use federal laws as our playbook, and like a good quarterback, we adapt to what we see coming at us," Becerra said. "As you consider enacting a federal privacy law, give us a playbook, but don’t preempt smart, nimble privacy protections that let states meet the varying challenges coming at us, from Mississippi, Washington state or California."
Becerra also stood in favor of a private right of action, while Ohlhausen said a federal private right of action should not be included in a federal law, as it would only result in class-action lawsuits that pay out attorneys and give little to actual victims, in her view.
The attorney general doesn't see it that way. Instead, Becerra sees a private right of action as an avenue for consumers to take power into their own hands when his office cannot.
"My office is working hard to hold companies accountable for violating privacy laws, but defending the privacy rights of 40 million Californians is a massive undertaking," Becerra said. "Consumers need the authority to pursue remedies themselves. They deserve their data in court. As California State Sen. Hannah-Beth Jackson, D-19th district, explained, "a right without a remedy is no right at all."
The Senate committee has its fair share of proposed privacy bills to work with, whether it's Wicker's
