Data privacy is something that most people want but then do not pay attention to until their information is compromised.  They then want something done, but there is no single answer yet, at least in Congress, to how their data can best be protected.  During this Data Privacy Week, the theme is Take Control of Your Data, which affords an opportunity to review what lawmakers across the country are doing to help protect consumer data privacy.

During the 117th Congress, it appeared that the House of Representatives was on the way to developing a data privacy law that would provide a national framework for consumers and businesses on how data should be protected.  H.R. 8152, the American Data Privacy and Protection Act (ADPPA), would have created a single set of rules and guidance for privacy.  However, this legislation was not without its flaws. 

The Council for Citizens Against Government Waste’s (CCAGW) July 19, 2022, letter to the House Energy and Commerce Committee was critical of the bill’s exemptions from preemption of several existing state laws, the inclusion of a private right of action, and an expansion of the current Federal Trade Commission’s authority, considering that agency’s abandonment of the consumer welfare standard and abject disregard for the economic impact of its proceedings on privacy, non-disclosure agreements, and merger applications.

CCAGW hoped that the 118th Congress would review the legislation and correct the flaws in the bill, but it has yet to be reintroduced.  Given the short legislative period and other higher priority bills that need to be addressed, especially during this election year, it is unlikely that a comprehensive privacy package will be enacted before the end of the Congress.  The House Energy and Commerce Subcommittee on Innovation, Data, and Commerce held hearings on March 1, 2023 and on April 27, 2023 to discuss data privacy, but to date, a comprehensive consumer data privacy bill similar to ADPPA has yet to be reintroduced.

This isn’t to say that Congress has little interest in protecting American’s privacy.  More than 700 pieces of legislation have been introduced in the House and Senate addressing various areas where increased privacy protections may be needed, including protecting financial, healthcare, online, speech, children, and taxpayer information.  The jurisdiction of these bills runs across nearly every House committee and at least two Senate committees

Given Congress’s inability to create a national privacy framework, states have been stepping in to fill the void.  According to the International Association of Privacy Professionals, as of January 19, 2024, states that have enacted a comprehensive data privacy law are California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia.  State legislatures that are considering privacy bills include Kentucky, Maine, Massachusetts, Michigan, Minnesota, Missouri, Nebraska, New York, North Carolina, Ohio, Pennsylvania, Vermont, and Wisconsin.  The New Hampshire legislature has passed a comprehensive data privacy law, but the bill has yet to be signed by the governor.

Unfortunately, this state-by-state approach to consumer data privacy creates conflicting laws that fail to provide the certainty business, consumers, and taxpayers need to protect their personal information from unauthorized disclosure.  Taking control of one’s data is a good ideal, and the National Cybersecurity Alliance offers some good tips on how to do that.  Increased awareness of data protection through events like Data Privacy Week are key to helping consumers take more control of the data they share, and protecting their personal information as much as possible, particularly when conducting business or sharing information online.