American Privacy Rights Act Would Give Users Ability to Control Personal Data
Two high-ranking Washington lawmakers unveiled a sweeping proposal over the weekend to give internet consumers new rights to control how tech giants collect and use their personal data. The proposal has been hailed as a legislative breakthrough, though its passage is far from certain. The version introduced is being described as a discussion draft.
Democratic Senator Maria Cantwell and Republican Congresswoman Cathy McMorris Rodgers introduced the American Privacy Rights Act. Cantwell and Rodgers chair the respective Senate and House committees with jurisdiction over the data privacy.
The draft legislation would limit data that companies can collect, retain and use to only what they need to provide their products and services. That would represent a major change from the current consent-based system that forces users to scroll through long privacy agreements and barrages them with pop-ups asking for their permission to be tracked online.
The measure would let Americans opt out of targeted advertising and view, correct, export or delete their data and stop its sale or transfer. It would create a national registry of data brokers that buy and sell personal information and require those companies to let people opt out of having their data collected and sold.
State Law Preemption
A key provision would preempt state privacy laws, including the seminal 2018 legislation adopted in California, except for state rules on health or financial data. The measure would allow individuals to file civil suits against tech companies that fail to delete data upon request.
“We have to have a bright line here where we’re catching bad actors and policing the information age,” Cantwell explained in an interview with The Washington Post. She said the compromise incorporates parts of state laws including California’s and Illinois’ protections for genetic and biometric data. “I think we have threaded a very important needle here,” Cantwell said. “We are preserving those standards that California and Illinois and Washington have.”
Rodgers, in an interview with The Spokesman-Review, described the proposal as a “historic piece of legislation that we’ve been working on for several years. Online privacy protections shouldn’t differ across state lines. What we see is a patchwork of state laws developing, and this draft that Senator Cantwell and I have agreed to will establish privacy protections that are stronger than any state law on the books.”
Previous Data Privacy Attempts
Rodgers introduced a major data privacy measure in the previous Congress, but it failed to move, in part because of opposition by Cantwell. One of her primary objections was the inability of consumers to bring lawsuits against tech companies, which Cantwell referred to as a “major enforcement hole”.
The compromise mirrors the previous House proposal ins several respects. It would force companies to minimize and disclose their collection practices and let users correct or delete their own data. It would bar companies from using data they collect to discriminate against protected classes. And it would require them to appoint executive officers responsible for ensuring compliance with the law.
Key differences in the compromise include allowing individuals to file lawsuits immediately and bar most arbitration agreements from interfering with the intent of the legislation. Cantwell said the changes make a “night and day” difference with the earlier House version.
Cantwell yielded to Rodgers on an exemption for companies with less than $40 million in annual gross revenue from its requirements, including conducting regular privacy reviews by data holders with more than $250 million in annual gross revenue.
The proposal falls short of President Biden’s call during his State of the Union speech for a prohibition on targeting minors with ads. It also doesn’t include a Biden recommendation to create a youth privacy and marketing division at the Federal Trade Commission.
Links to a Broader Bill
The Cantwell-Rodgers proposal could be paired in final legislation with other complementary measures that deal with child safety on digital platforms, according to a senior committee aide. Senators Richard Blumenthal (D-Connecticut) and Marsha Blackburn (R-Tennessee) say they have secured enough support to move forward on child digital safety legislation.
The Cantwell-Rodgers compromise also could be intertwined with House-passed legislation to force TikTok’s Chinese owner to divest or face a national ban. The House also passed a less headline-grabbing bill aimed at stopping data brokers from selling U.S. user information to “foreign adversaries”.
Cantwell and Rodgers view their bill as a complement to those bills, not a replacement, and they are committed to working to pass other legislation.
A Discussion Draft
The Senate and House committees released versions of the proposal over the weekend to facilitate discussion. New Jersey Congressman Frank Pallone, the ranking Democrat on the House Energy and Commerce Committee, called it a “very strong discussion draft”, but said provisions relating to children’s privacy could be strengthened.
Brad Smith, vice chairman and president of Washington-based Microsoft, said the proposal is a “good deal [that would] provide clarity by establishing a national standard on privacy.”
Rodgers said she is “having conversations with both House and Senate leadership right now.” “I’ve had many conversations with both Mr. Pallone and Senator [Ted] Cruz on this topic, and we all recognize that people want and need privacy rights,” Rodgers said. “This is a discussion draft that Senator Cantwell and I have hammered out, but we’re still open to constructive feedback.”
Cantwell said she hasn’t asked Senate Majority Leader Chuck Schumer for a commitment to bring the bill to the floor for a vote, but she said the New York Democrat knows about the legislation and she’s optimistic that it can pass by year’s end.
“If you restrict the amount of data out there,
you can restrict the amount of data used to train AI.”
Compromise Back Story
Shannon Smith, a Pasco native and the lead Democratic staffer on Senate Commerce, is given credit for stitching together the data privacy compromise’s complex parts.
“If you can restrict the amount of data that’s out there, then you can restrict the amount of data that’s used to train AI,” Smith said in an interview. “That doesn’t mean you don’t still need legislation around AI or you don’t need some other enhanced protections for kids, but this does the back-end work that will make those statutes a lot easier to enact and implement.”
Cantwell says negotiations were aided by a strong relationship between her and Rodgers forged by working through “really thorny problems,” including wildfires and a 2020 tribal settlement for damage caused by Grand Coulee Dam.
“It’s been an exercise in building trust,” Rodgers said. “We come from a state that has a large tech presence, a state that has led in technology, and I think all of that has played a part in bringing us together at this moment. And it really is a significant moment for us to lead, both for Washington state and for the nation.”
Cantwell is seeking re-election this year. Rodgers is retiring after this term.
