Introduction

Beginning with the Communications Act of 1934,¹ which provided protection for telephone and cable customers’ private information, several laws have been passed by Congress to protect data privacy and personal information.  They include the Financial Modernization Act of 1999 (Gramm-Leach-Bliley Act) which regulates privacy for banking, credit reporting, and financial wire transactions;² the Children’s Online Privacy Protection Act (COPPA), which protects children engaging in online activities;³ the Driver’s Privacy Protection Act of 1994, which prohibits the release of personal information by state agencies on drivers registered within their states;⁴ the Electronic Communications Privacy Act of 1986 (ECPA) which regulates the access and use of electronic communications by law enforcement;⁵ the Family Educational Rights and Privacy Act (FERPA), enacted in 1974, which protects the privacy of student information for secondary and college students and their families;⁶ the Healthcare Insurance Portability and Accountability Act of 1996, which protects a patient’s personal healthcare information;⁷ and the Video Privacy Protection Act of 1988 (VPPA), which prohibits the disclosure of video rental records that contain personally identifiable information (PII).⁸ 

But as the amount of data held by private corporations like banking institutions, e-commerce sites, internet service providers (ISPs), online platforms, and retailers, among others, has increased exponentially, there is now a need to both update these laws, many of which are more than 30 years old, and develop a comprehensive federal data privacy framework.

The failure by Congress to accomplish this objective has led to many states enacting or considering their own data privacy laws and regulations.  This conflicting, confusing, and complex hodgepodge approach is leaving consumers and businesses struggling to decipher what they need to do based on where they are located, and uncertainty about whether consumers have adequate protection under current law should their identities or other personal information be disclosed without their permission either through deliberate or accidental disclosures.

As technology becomes even more integrated into everyday life, it is more critical than ever that Congress devise a national framework for consumer data privacy that is flexible enough to meet the needs of consumers, provides certainty for businesses, and can be adapted for new innovations.

Privacy Laws and Regulations in Other Countries

The strictest privacy laws in the world, the General Data Protection Regulation (GDPR) were adopted by the European Parliament on April 14, 2016, and became directly applicable to all European Union (EU) member states on May 25, 2018.  The GDPR imposes onerous and costly requirements for data protection by businesses or other entities that process the personal data of individuals in the member states of the EU, regardless of where the data processing takes place, including U.S. companies doing business in the EU.⁹ 

The GDPR has had a significant negative economic impact on countries and businesses in the EU.  Jennifer Huddleston of the American Action Forum noted that, “venture capital investment in small and micro companies decreased by $3.4 million per week following GDPR’s enactment” and such regulations have also had a negative impact on “other social priorities such as free speech.”¹⁰

In her testimony before the Senate Judiciary Committee on March 12, 2019, American Enterprise Institute Visiting Scholar Roslyn Layton spotlighted 10 problems with the GDPR.  She said that the regulations 1) strengthen the largest players; 2) weaken small- and medium-sized firms; 3) are cost prohibitive for many firms; 4) silence free speech and expression; 5) threaten innovation and research; 6) increase cybersecurity risk; 7) create risks for identity theft and online fraud; 8) reduce trust online; 9) use the pretense of customer control to increase the power of government; and, 10) fail to meaningfully incorporate the role of privacy enhancing innovation and consumer education in data protection.¹¹

A CNBC report on the impact of the GDPR after one year of being in effect cited the struggles some EU countries faced as they tried staffing regulatory offices, and how “consumers become blind to an avalanche of privacy pop-up notices and companies struggle with new internal data bureaucracies.”¹²  In April 2020, The New York Times noted that “even the law’s biggest supporters are frustrated with how it has worked.”¹³

An additional burden on U.S. companies trying to comply with the GDPR, is the matter of data transfers from EU-member countries to non-EU member countries.  This is particularly true for U.S.-based countries that have physical presence in EU countries and are capable of transferring data from a server located in the EU to a server based in the U.S., even if that data transfer is temporary or for performing backup storage for maintenance purposes.  On July 16, 2020, the European Union Court of Justice (ECJ) issued a decision in Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems, Case C-311/18 (Schrems II).  In its ruling, the court determined that standard contractual clauses deemed whether the recipient country’s law concerning government access to data meets the privacy protections under GDPR.  The ECJ also invalidated the Privacy Shield Frameworks agreement, which had set up a mechanism to transfer personal data from the EU to the U.S.¹⁴

In September 2020, Department of Commerce Deputy Assistant Secretary for Services James M. Sullivan issued an explanatory letter on the impact and challenges of Schrems II on U.S. companies along with a white paper discussing how companies might be able to navigate the current data privacy standard until a new agreement can be forged.¹⁵  On July 8, 2021, the Information Technology & Innovation Foundation (ITIF) released a report on how Schrems II  has undermined sharing agreements between countries and imposed a certain level of distrust of service providers based in the U.S.  The report encouraged the EU and U.S. to resolve these issues quickly and formulate an agreement that will be sustainable into the future.¹⁶

On March 25, 2022, President Biden and European Commission President Ursula von der Leyen announced that a provisional agreement had been reached that recognized the ECJ’s decision and provided stronger legal protections for data transfers.¹⁷  Whether this agreement will develop into a permanent resolution for data privacy concerns that will satisfy both businesses and privacy advocates remain to be seen.

Privacy Laws and Regulations in the States

Despite the clear problems with the GDPR, the state of California decided it would be a good model for its own data privacy laws.  On June 28, 2018, the California Consumer Privacy Act (CCPA) was signed into law by Gov. Jerry Brown (D).¹⁸  The bill, which was rushed through the legislature in a few days, imposes extremely burdensome requirements on how companies must store and provide access to consumers’ personal information, as well as harsh restrictions on the types of product and service options and discounts companies may offer to their customers. 

The CCPA also includes a private right of action, which gives individuals the ability to file suit against any company they believe violated their privacy rights.  As a result, businesses could be held hostage by thousands of single lawsuits that threaten to bankrupt them.  The private right of action and other harmful provisions of the CCPA underscore the risks of other states passing similar legislation. 

The rush to pass CCPA forced the legislature to enact two bills to clarify and correct several problems.  The first bill, AB 713, provided exceptions for data that had been “deidentified in accordance with specified federal law.”¹⁹  The second bill, AB 1281, extended exemptions to information collected by a business from job applicants, employees, owners, directors, officers, medical staff members, and contractors in addition to information related to a “written or verbal communication or transaction between a business and a consumer.”²⁰ 

On November 3, 2020, California voters approved Proposition 24, which adopted the California Privacy Rights Act (CPRA).²¹  CPRA amends the CCPA to extend employee and business to business (B2B) exemptions for personal information; creates a higher threshold for the definition of a business effective January 1, 2023; creates a new definition for “sharing” personal information for “cross-context behavioral advertising;” includes the right to op-out; and requires the inclusion of a “Do Not Sell or Share My Personal Information” link.  CPRA also imposes limits on the use of sensitive personal information like those imposed by the GDPR; creates new notice requirements at the point of data collection; imposes new requirements on service provider agreements; expands private rights of action; improves exemptions for clinical trials; and creates a new state agency dedicated to privacy enforcement, funded with $5 million for 2020-2021 and $10 million each following year.²² 

The state of Florida and its residents have made it quite clear that they do not want to be anything like California.  It was therefore surprising that the normally pro-business and fiscally conservative Republican majority House of Representatives passed HB 9 by a vote of 102-8 on March 2, 2022.²³  The data privacy bill includes restrictive and burdensome provisions that are similar to the CCPA, including a private right of action. 

A Florida TaxWatch analysis found that HB 9 provides 10 new privacy restrictions and would cut Florida’s gross operating surplus by $17.2 billion annually.²⁴  The cost of compliance would have a disproportionate impact on small businesses that lack the resources to pay for the new restrictions.  Entrepreneurs would be less inclined to choose Florida as the place to grow their new companies when faced with high start-up and compliance costs.  Instead, they would choose states with more reasonable data privacy laws.

The complexity and cost of complying with HB 9 were compounded further by the inclusion of a private right of action.  This right would result in frivolous lawsuits against every type of business in Florida, from large companies to the local pharmacy and grocery store, if someone thinks their privacy may have been violated.  These types of provisions are a gold mine for trial lawyers, and a nightmare for businesses.

Even if a business is ultimately victorious, it would be difficult to recoup the time, money and reputation loss spent in needless litigation.  The increased costs will be shifted to consumers, who end up paying higher prices for goods and services.  Like the CCPA, the strict regulations and high compliance costs of HB 9 would make it more difficult for businesses to provide their products to consumers and protect the privacy of their customers, while also increasing barriers to entry.  Fortunately for Florida businesses and taxpayers, HB 9 was not considered by the Senate before the legislative session ended on March 14, 2022, and it will not become law in the state.

On the opposite end of the spectrum of state laws stand Virginia’s Consumer Data Protection Act (CDPA), which was signed into law by Gov. Ralph Northam (D) on March 31, 2020,²⁵ and the Colorado Privacy Act (CPA), signed into law by Gov. Jared Polis (D) on July 8, 2021.²⁶  These laws contain clear guidelines, limitations on the type and amount of data collected based on the context of the situation, consumer consent, opt-out clauses, and flexible levels of protection.  Further, the CPDA and CPA do not contain a private right of action, or the stricter requirements featured in California’s data privacy laws.  In many ways, Virginia and Colorado stand out among the best examples of data privacy laws enacted at the state level.  However, these laws remain state-based and therefore do not achieve the goal of protecting consumer data privacy with a single law that covers every state.

And despite their positive provisions, the CDPA and CPA have their differences.  While some states may adopt some of these provisions, there is no guarantee that they will adopt the precise language.  Other states may choose to follow the more burdensome model of California or the GDPR when crafting data privacy legislation.  This wide variety of approaches makes it extremely difficult for consumers and businesses, particularly small businesses, to navigate the complex nuances of so many different laws.

In addition to California, Colorado, Florida, and Virginia, numerous other states have considered bills covering data brokers and consumer data privacy over the past several years.  During the 2022 legislative sessions, they included Alaska’s HB 159,²⁷ Connecticut’s SB 6,²⁸ Hawaii’s SB 2051,²⁹ Indiana’s SB 358,³⁰ Ohio’s HB 376,³¹ Oklahoma’s HB 2969,³² New Hampshire’s HB 1413,³³ Wisconsin’s AB 957,³⁴ Washington’s SB 5813,³⁵ and Utah’s SB 227,³⁶ and the Council for Citizens Against Government Waste wrote letters to the legislatures on each of these bills.  There are unique provisions and applications that make each bill distinct from the others.  For example, New Hampshire’s HB 1413 singles out only one industry, broadband providers, whereas Hawaii’s SB 2051 applies to data brokers more broadly.  While those two bills focus on data brokering, others do not address data brokering at all.  Other bills cover consumer and business privacy concerns, including the brokering of data.  If these bills were all enacted into law, companies and consumers would find it extremely difficult and costly to comply.

The impact on smaller companies will be particularly damaging, as they may choose not to operate in states like California while still maintaining a presence in Colorado and Virginia, or states that do not have any data privacy laws.  Consequently, consumers in many states will not have access to the same innovations as their friends and neighbors across state lines.  Moreover, consumers will be confused over what is protected and what rights they have any time they engage in interstate travel or conduct online activities to purchase goods and services. 

According to a January 24, 2022, ITIF report, a 50-state patchwork of laws would cost $1 trillion more over 10 years than if Congress enacted a national data privacy law.³⁷  The report found that under California’s law alone, out of state compliance costs would total an estimated $12.5 billion while in-state compliance costs would total $46.4 billion.  Businesses are going to be forced to raise prices to pay for these additional costs, and they will be passed on to consumers, or they will simply not do any business in California.  Rather than allow this costly and confusing patchwork of laws to continue, Congress should use its power under the Commerce Clause of the Constitution to establish a unified framework for the entire nation.

Past Federal Legislation

In 2012, Citizens Against Government Waste (CAGW) reported on efforts to develop a set of national consumer privacy protection laws as reports about the tracking and monitoring of consumers’ online use by companies and government entities increased.³⁸  Former President Barack Obama encouraged Congress to enact a modern set of privacy rules, offering a draft proposal for a Consumer Privacy Bill of Rights Act.³⁹  Yet 10 years later, Congress has still not modernized consumer privacy laws, or enacted a Consumer Privacy Bill of Rights.

Updating laws related to electronic communications is essential to keep up with modern technology.  The Electronic Communications Privacy Law (ECPA), enacted in 1986, was one of the first laws to protect electronic communications.  It has rapidly become outdated, as the manner in which documents and other digital “papers” are stored has evolved and online data and cloud storage solutions for electronic communications and documents have developed.  ECPA fails to provide adequate protection for documents and communications stored remotely or by cloud service providers, including email, against unreasonable searches and seizures.  Courts continue to struggle with how to apply the Fourth Amendment’s protections, with the advent of newer communications platforms, even more so when dealing with myriad state and local laws being enacted to protect consumer privacy. 

On July 27, 2017, Sens. Mike Lee (R-Utah), and Patrick Leahy (D-Vt.) introduced S. 1657, the ECPA Modernization Act of 2017.  The Lee-Leahy bill would have amended ECPA by extending the same legal protections that data stored locally in one’s home or office receives to information stored online.  The process for obtaining a warrant would apply equally to all government agencies seeking access to content, which creates continuity and certainty for both businesses and individuals that may be subject to such a search for information.  However, this legislation was not passed by either chamber of Congress. 

During the 116th Congress, several bills to develop a national framework for consumer privacy were introduced in both the House and Senate, including H.R. 2013, the Information Transparency & Personal Data Control Act, introduced by Rep. Suzan K. DelBene (D-Wash.);⁴⁰ S. 2968, the Consumer Online Privacy Rights Act, introduced by Sen. Maria Cantwell (D-Wash.);⁴¹ S. 3300, the Data Protection Act of 2020, introduced by Sen. Kirsten Gillibrand (D-N.Y.);⁴² S. 3456, the Consumer Data Privacy and Security Act of 2020, introduced by Sen. Jerry Moran (R-Kans.);⁴³ and S. 4626, the Setting an American Framework to Ensure Data Access, Transparency, and Accountability Act (the SAFE DATA Act), introduced by Sens. Roger Wicker (R-Miss.), John Thune (R-S.D.), Marsha Blackburn (R-Tenn.), and Deb Fischer (R-Neb.).⁴⁴

Again, these bills have not been enacted despite numerous hearings and town hall meetings to discuss the framework for a national privacy legislation.

Current Federal Legislation

During the 117th Congress, more than 30 bills have been introduced to address the nation’s concerns about how personal identifying information is shared and used by those who collect data.⁴⁵  The bills demonstrate the bipartisan desire to protect consumers online, while at the same time offering a beginning framework for legislation that will work across all industries, and particularly for those that collect data online. 

Unfortunately, there has been some confusion about whether a comprehensive data privacy bill should also include antitrust reform, revising or eliminating the consumer welfare standard, addressing online censorship and moderation, media rules, and breaking apart large technology companies.  These are all different issues and have no place in a consumer data privacy law.  Legislators working on consumer privacy should ignore the calls to include any of these matters, any one of which would likely lead to the defeat of such legislation.  While has often proven difficult for Congress to pass legislation focused solely on one issue, members should focus only on one issue and work toward a national framework for consumer data privacy that will provide consumers and businesses a set of tools to protect data privacy.

Adding to the confusion, the Federal Trade Commission (FTC) has also been maneuvering toward taking up privacy rules as it attempts to streamlines its processes under Section 18 of the FTC Act.⁴⁶  However, as noted by Senate Commerce, Science, and Transportation Ranking Member Roger Wicker (R-Miss.), House Energy and Commerce Ranking Member Cathy McMorris Rogers (R-Wash.), and FTC Commissioner Noah Phillips, “This would be a step in the wrong direction.  America needs a national consumer privacy law, but such a law must be the product of Congress.”⁴⁷

In addition to the effort to add technology and telecommunications provisions to data privacy bills, several of the consumer privacy bills introduced during the 117th Congress have been related to COVID-19 and how information relating to vaccines and individual personal health information is managed.  They cover contact tracing, vaccine passports, personally identifiable information (PII), and wearables. 

These crisis-, industry-, and product-specific legislation will not solve the overreaching need for one standard consumer data privacy law that is vendor and industry neutral but provides the protection Americans want and need.  Like the 116th Congress, there are several bills that have been introduced in the 117th Congress that seek to accomplish that objective.

On April 29, 2021, Sen. Jerry Moran (R-Kans.) introduced S. 1494, the Consumer Data Privacy and Security Act.⁴⁸  The legislation would “establish a clear federal standard for data privacy protection, giving businesses a uniform standard rather than a patchwork of confusing state laws; provide consumers with control over their own data to access , correct and erase their personal data; require businesses that collect and process a significant amount of personal data to take extra precautionary steps to protect and responsibly process that data; prohibit companies from collecting data without consumers’ consent with limited and specific exceptions; require businesses to develop and implement robust data security programs to protect personal data from unauthorized access and disclosure; equip the FTC and state attorneys general with authority to uniformly enforce federal consumer privacy protections while providing the FTC the resources necessary to carry out those authorities.⁴⁹  This bill creates a baseline for hearings and additional bill discussions to help formulate a comprehensive national framework.

On November 1, 2021, Rep. Filemon Vela (D-Texas) introduced H.R. 5807, the DATA Privacy Act.  H.R. 5807 establishes baseline data security requirements for businesses that collect, process, store, or disclose information on at least 50,000 individuals over a 12-month period.  These businesses would be required to give consumers an accessible notice of the business’s privacy practices relating to this information and appoint a privacy officer to oversee compliance of the privacy practices.  The bill also requires the FTC to promulgate rules requiring businesses to limit why and how much consumer data is collected; provides consumers with the ability to opt-in or opt-out of data collection; gives consumers the ability to access, revise, transmit, and delete information collected about themselves, and establishes information security standards based on the sensitivity and identifiability of the collected data.⁵⁰ 

On November 3, 2021, Reps. Cathy McMorris Rogers (R-Wash.) and Gus Bilirakis (R-Fla.) announced draft legislation, entitled the Control Our Data Act, which would promote innovation, increase transparency and accountability, create a clear set of rules for protecting consumers’ data privacy.⁵¹  The bill draft includes flexibility to account for large businesses and entities that have the means to invest in consumer data privacy, as well as small to mid-sized entities (SMEs) to protect them from undue regulatory burdens.  Based on four principles for consumer data privacy that acknowledge that the internet does not stop at state lines, therefore there should be one standard set of rules for the entire country; people need to understand how their information is collected, used, and shared, and companies that misuse this information must be held accountable; federal legislation must ensure companies are implementing reasonable measures to protect individuals’ PII; and, small businesses and innovation must be protected with a standard privacy law that is not overreaching, forcing businesses to hire attorneys instead of innovating.⁵²  As of publication date, the final text of this draft bill has yet to be introduced in the 117th Congress.

It can be expected that more legislation will be drafted and introduced during the second session of the 117th Congress.  However, if legislation is going to pass, representatives and senators must come to an agreement quickly to move forward on building a consensus with a bipartisan agreement that will work nationwide.

CAGW’s Recommendations for Consumer Data Privacy

On November 8, 2018, CAGW offered the following recommendations for consumer-based privacy to the National Telecommunications and Information Administration, which can also serve as a guide for any legislative initiative undertaken by Congress:

1. “National Privacy Framework: Because of the unique nature of the internet ecosystem and its presence beyond state borders, a clear and concise national data privacy framework is necessary to provide consistency and certainty for businesses and consumers alike.
2. “Consumer Choice and Control: Businesses should provide consumers with easy-to-understand privacy choices based on the sensitivity of their personal data and how it will be used or disclosed, consistent with the FTC’s privacy enforcement guidance.  Businesses should provide consumers with an opt-out choice to use their non-sensitive customer information for personalized third-party marketing.  Businesses should be able to continue to rely on implied consent to use customer information for activities such as service fulfillment and support, fraud prevention, market research, product development, network management and security, compliance with the law, and first-party marketing.
3. “Transparency: Consumers should be provided with clear, comprehensible, accurate, and continuously available privacy notices by businesses collecting, using, or sharing consumer data that describe in detail the information being collected, how that information will be used, and whether the information will be sold or shared with third parties.  Should customer information be sold or shared with a third party, customers must be notified about the types of third parties to whom their information has been given and for what purpose.
4. “Data Minimization and Contextuality: Consumers should expect reasonable limits on the amount of personal data that organizations will collect, use, and disclose, consistent with the context in which that data is provided.  Every effort should be made to de-identify and delete data as promptly as possible when it is no longer necessary.
5. “Flexibility: Different types of data require separate methods and standards of protection.  For example, sensitive health care data and financial data require a higher level of security than a social media account or a computer’s IP address.  Therefore, policies must be consistent with the type of data being collected and how it is to be used.
6. “Data Security and Breach Notification: Consumers should expect that the personal data they share with other entities is maintained in a secure environment.  Information technology systems are under constant attack; breaches have and will continue to occur.  In the event of a data breach in which there is a reasonable likelihood of misuse and consumer harm, consumers should expect timely notification of the event, and an offer by the entity breached as to the remedies available to make the consumer as whole as possible, including credit protection services, fraud alerts, and credit monitoring through credit reporting agencies.”⁵³

These six recommendations provide the groundwork for a national privacy policy going forward, in a technology- and industry-neutral manner, and should be part of the overall privacy framework discussion.  A national data privacy law must preempt these state-based laws while providing consumers the protections they need and enabling businesses to follow one set of standards without worrying about whether their customers have crossed a state boundary.

Conclusion

It is long past time for Congress to enact a federal law to protect consumers’ personal information.  The patchwork of state laws that have been enacted and are being considered are making it costly and difficult for consumers and businesses to comply.  Congress has the ability to solve this problem, but members need to act and move forward quickly on one of the bills that has been introduced or a combination thereof and put together a national framework for privacy protection that will simplify compliance, protect individual personal data, and encourage continued innovation.

Endnotes