With the introduction of the draft American Data Privacy and Protection Act on June 3, 2022, and the first hearing held on June 14, 2022, Congress may finally move forward on providing a national consumer data privacy framework.  While many other bills have been introduced on data privacy in the 117th Congress, this bill has drawn more attention than the others since the primary co-sponsors are House Energy and Commerce Committee Chairman Frank Pallone, Jr. (D-N.J.) and Ranking Member Cathy McMorris Rodgers (R-Wash.) and Senate Committee on Commerce, Science, and Transportation Ranking Member Roger Wicker (R-Miss.). 

The failure to pass a national framework for data privacy has left a void that is being filled by the states.  During the 2022 legislative sessions, 35 states considered privacy bills.  While only Connecticut and Utah had bills signed into law, the growing patchwork of conflicting data privacy rules is creating uncertainty and significant costs for compliance, especially for small businesses.  According to a January 24, 2022, Information Technology and Innovation Foundation report, 50 different state privacy laws could cost $1 trillion more over 10 years than a national standard adopted by Congress.

A June 2021 Cisco Consumer Privacy Survey found that consumers are demanding action that will give them transparency and control over business data practices.  While there is a positive view of privacy laws worldwide, awareness of the more than 140 national and multinational laws relating to consumer data privacy is lacking and 76 percent of respondents said it is too difficult for them to understand what is going on with their personal information and how it is being used.

The new requirements for information sharing during the pandemic were supported as being necessary for public health and safety, but that did not reduce the desire for privacy protection. Consumers are also concerned about how their personal information is used by artificial intelligence, which has further eroded trust in using technology. 

Citizens Against Government Waste first offered recommendations for a national data privacy framework in its November 8, 2018, comments to the National Telecommunications and Information Administration, which were reiterated in Critical Waste Issues for the 117th Congress, and in the March 2022 report, The Path to a National Privacy Framework.  Among the recommendations were a requirement that businesses should give consumers understandable privacy choices, clear and continuously available privacy notices, and immediate notice of a privacy breach.  There should also be reasonable limits on the collection and use of personal data, and flexibility in the level of security depending on the type of information being collected.

The draft bill has some positive provisions and some that are likely to make data privacy even more complex, confusing, and costly.  Among the provisions that are included from CAGW’s recommendations is the creation of a national privacy framework that gives consumers choices on how their information will be used, provides an opt-out capability, increases transparency on how their data will be used, provides for data minimization, and provides increased data protection and security.  However, the bill is far from perfect.  Chief among the issues raised at the June 14 hearing were unclear definitions that could lead to lawsuits, language that exceeds current Federal Trade Commission guidance on privacy, and whether consumers will be able to choose to allow the use of their personal identifying information to their own benefit. 

The inclusion of a private right of action will allow frivolous lawsuits, the cost of which will be passed on to consumers.  The bill also provides for several exceptions to its preemption authority, including an exception for existing state laws that provide for a private right of action.  A national framework is supposed to create a consistent set of data privacy laws rather than continue the status quo of confusing and complex state statutes.  As currently written, there appears to also be a ban on companies offering discounts to existing customers based on their past purchases.  Eliminating these discounts will not only reduce consumer choice but also increase costs at a time when inflation is already at a 40-year high. 

As the debate over data privacy moves forward, Congress should ensure that any legislation that gets passed the House and Senate protects consumers without provisions that will increase costs through a private right of action, the continuation of a patchwork of state laws, or the elimination of online cost-saving offers.