Wicker Says His Privacy Draft, Cantwell Bill Stronger Than CCPA

Privacy proposals from Senate Commerce Committee Republicans and Democrats both provide stronger consumer protections than California’s privacy law, said Chairman Roger Wicker, R-Miss., Wednesday. During a long-awaited hearing, ranking member Maria Cantwell, D-Wash., raised concerns about third-party data sharing. Lawmakers gave varying views on a private right of action.

There are no specific plans to get the original Commerce privacy group back together, though it “might not be a bad idea,” Wicker told reporters. He noted that original members Sens. Richard Blumenthal, D-Conn., and Jerry Moran, R-Kan., who are working on a bipartisan proposal in addition to Wicker and Cantwell, made a good point that the ultimate bill will need bipartisan support for Senate passage. “There’s a solution out there,” Wicker said. He would be open to discussing limited private right of action, specifically injunctive relief, in the bill with Cantwell (see 1912030060).

“Private right of action should include” more than injunctive relief, Blumenthal told reporters. Injunctive relief “at the very least would guarantee consumers” could seek their own legal redress, he said. He told us he and Moran “may” bring other lawmakers into bipartisan talks about legislation.

Blumenthal asked the five witnesses to work with the committee to reach a conclusion on private right of action. The panelists disagreed about such a measure. Microsoft Corporate Vice President Julie Brill noted California’s law includes a very limited right of action.

Cantwell asked witnesses whether federal legislation should limit third-party sharing of data. The Center for Democracy and Technology supports such limits, said Privacy and Data Director Michelle Richardson. Georgetown Law Center on Privacy & Technology Executive Director Laura Moy called third-party sharing a “huge problem.”

Moran asked whether it’s appropriate to include five specific provisions in legislation that pre-empts state law: standard transparency requirements on data use; first-time civil penalty authority for the FTC; targeted rulemaking authority; new authorization for FTC staffing needs; and the ability for state attorneys general to complement FTC enforcement. All five panelists agreed with the provisions. Moran said he's glad Wicker and Cantwell offered proposals but noted the ultimate privacy bill will need bipartisan support and 60 votes in the Senate.

Only a bipartisan proposal has a chance of clearing the Senate, said Senate Majority Whip John Thune, R-S.D. Congress needs to ensure the U.S. avoids having a patchwork of conflicting state privacy laws, Thune said.

Microsoft favors four key privacy principles, said Brill: transparency about data use; consumer empowerment to access and move data; corporate responsibility of businesses to be good stewards of information; and strong enforcement through a central regulator and state attorneys general. The FTC's privacy staff should be boosted from about 40 employees to 500, said Brill, a former Democratic commissioner.

The 21st Century Privacy Coalition wants a federal bill to provide clarity on data practices; a national, uniform set of protections; and strong enforcement, said co-Chair Maureen Ohlhausen, a former GOP commissioner. Congress should also define sensitive and nonsensitive data, which should drive consent requirements, she said. She opposed a private right of action, saying it will primarily benefit lawyers, not actual victims, in class-action lawsuits.

That the FTC has about 40 people working on privacy issues is “plainly not enough,” said Moy. She said Cantwell’s bill offers the strongest protections, compared with other federal bills, and called a private right of action the “true force multiplier.” She urged Congress not to pre-empt existing state protections.

Walmart shares broader industry concerns about Cantwell’s bill regarding private right of action and lack of pre-emption, said Senior Vice President Nuala O’Connor. A comprehensive federal bill is needed in place of a patchwork of state laws, she said. O’Connor was hired by the retailer from CDT, which she had run.

CDT believes the right solution on a private right of action lies between nothing and allowing individuals to sue over everything, said Richardson. All 50 states have fair and deceptive laws that include some form of private right of action, she noted. Congress needs to shift the burden from consumers to companies, with clear rules about data use and prohibited activities, she said.

Sen. Marsha Blackburn, R-Tenn., told reporters Congress needs to avoid disadvantaging innovators with a private right of action that could disadvantage startups. She said whether it’s Cantwell’s bill or Wicker’s draft, there are a lot of elements from the Balancing the Rights of Web Surfers Equally and Responsibly (Browser) Act (S-1116). She noted all five witnesses favored federal pre-emption, depending on the strength of the bill.

Consumers effectively have no choice when it comes to notice and consent, said Sen. Brian Schatz, D-Hawaii. There are too many notices, which are too long, he said. The idea that any user is going to opt out of the digital world is “preposterous,” he said.

Blackburn asked at the hearing whether large companies could use private right of action to increase small competitors' costs. She argued the FTC is the most qualified privacy regulator. Sen. Dan Sullivan, R-Alaska, also was skeptical about including such a remedy.