Congress may be closer than ever to passing a comprehensive bill data privacy framework after top House and Senate committee leaders released a new proposal on Sunday.
The bipartisan proposal, called the American Privacy Rights Act, or APRA, would limit the types of consumers data that companies can collect, keep and use what they need to operate their services. Users would also be allowed to opt out of targeted advertising and would have the ability to view, correct, delete and download their data from online services. The proposal would also create a national registry of data brokersand require these companies to allow users to opt out of the sale of their data.
“This historic legislation gives Americans the right to control where their information goes and who can sell it,” Cathy McMorris Rodgers, chairwoman of the House Energy and Commerce Committee, said Sunday. “It reins in Big Tech by prohibiting it from tracking, predicting and manipulating people's behaviors for profit without their knowledge or consent. Americans overwhelmingly want these rights, and they are counting on us, their elected representatives, to act. »
Congress attempted to develop a comprehensive federal law protect user data for decades. Lawmakers, however, remained divided on whether this legislation should prevent states from enacting stricter rules and whether to allow a “private right of action” that would allow individuals to sue companies in response to privacy violations.
In a interview with the Spokesperson Review On Sunday, McMorris Rodgers asserted that the bill's text was stronger than any active law, apparently in an attempt to assuage the concerns of Democrats who have long fought against attempts to preempt preexisting state-level protections. State. APRA allows states to enact their own privacy laws related to civil rights and consumer protection, among other exceptions.
During the previous session of Congress, leaders of the House Energy and Commerce committees negotiated a deal with Roger Wicker, the top Republican on the Senate Commerce Committee, on a bill that would override the state laws, except the California Consumer Privacy Act and the Illinois Biometric Information Privacy Act. This measure, titled US Privacy and Data Protection Act, also created a weaker private right of action than most Democrats were willing to support. Cantwell declined to support the measure, instead circulating his own bill. ADPPA was not reintroduced, but APRA was designed as a compromise.
“I think we've threaded a very important needle here,” Cantwell told the Spokesperson Review. “We are preserving the standards in California, Illinois and Washington.”
APRA includes language from California's landmark privacy law, allowing people to sue companies when they are harmed by a data breach. It also gives the Federal Trade Commission, state attorneys general and private citizens the power to sue companies when they violate the law.
Categories of data that would be affected by APRA include certain categories of “information that identifies or is linked or reasonably linked to an individual or device”, according to a Senate Commerce Committee Summary of the legislation. Small businesses – those with an annual turnover of $40 million or less and limited data collection – would be exempt from APRA, with enforcement focused on businesses with a turnover annual income of $250 million or more. Governments and “entities working on behalf of governments” are excluded from the bill, as are the National Center for Missing and Exploited Children and, in addition to certain cybersecurity provisions, nonprofit organizations “fighting against fraud”.
U.S. Rep. Frank Pallone, the top Democrat on the House Energy and Commerce Committee, called the plan “very strong.” in a statement on Sundaybut said he wanted to “strengthen” it with tougher child safety provisions.
It remains to be seen whether APRA will receive the support necessary for its approval. On Sunday, committee aides said discussions about other lawmakers signing the legislation were ongoing. The current proposal is a “discussion draft”; Although there is no official date for a bill to be introduced, Cantwell and McMorris Rodgers will likely review the text with their colleagues for feedback in the coming weeks and plan to send it to committees this month.