Cantwell: Hearing Shows Support for Private Right of Action

The Senate Commerce Committee’s privacy hearing Wednesday showed there’s “more commonality than expected,” Chair Maria Cantwell, D-Wash., told reporters. Federal preemption remains a hurdle, but ranking member Roger Wicker, R-Miss., told us he and Cantwell are going to “intensify” efforts to reach agreement over the next two months.

All four witnesses, including ex-FTC officials from both parties, testified that Congress should pass privacy legislation with a private right of action, though they want guardrails. “Panelists were basically saying you need a private right of action,” Cantwell told reporters. “I don’t think that’s where we were a year ago. People weren’t saying, ‘Yes, let’s have one.’ People were like, ‘Never.’ I thought it was a very good panel discussion.”

Cantwell remains unconvinced about including federal preemption, which Wicker said is a “must-have” for Republicans. Preemption should be one of the last details addressed when negotiating legislation, said Cantwell: State data security laws would be “hard to override, and I’m not sure some of my colleagues would even want to do that.”

Cantwell said she’s proud of the work she did last year with Wicker, which resulted in two separate bills. “Since then, we’ve had a lot more information and obviously built our working relationship with committee members,” she said.

Wicker said Republicans aren’t backing off preemption: “I just don’t see that we’ve accomplished anything if ... we have substantial differences between the 50 states. ... Give us two months. Maria and I might come up with something that we can introduce. There’s hope. We’re going to intensify our sincere effort to come to an agreement.”

Wicker said in opening remarks he remains open to a narrow private right of action. Cantwell said she appreciates his willingness to discuss. Wicker urged President Joe Biden to appoint a senior White House staff member to be a privacy liaison to Congress and to prioritize enacting a data privacy law this year.

Cantwell said she’s pleased the House’s reconciliation bill includes $1 billion over 10 years for the FTC to establish a privacy bureau. The four witnesses agreed the FTC needs more resources, more statutory authority and the ability to recoup civil penalties on the first offense. Legislation should include a private right of action, but it shouldn’t allow high punitive damages for an initial violation, said ex-FTC Commissioner Maureen Ohlhausen, now at Baker Botts. Penalties should be focused on repeated and egregious violations, she said.

The Federal Privacy Act could be a model for a private right of action, said ex-FTC Consumer Protection Bureau Director David Vladeck, now at Georgetown Law. That law has worked well and allows nominal damages through a private right of action and curbs attorneys’ fees, he said. ACT|The App Association President Morgan Reed agreed a private right of action needs guardrails, and companies should have time to cure potential violations. Ex-FTC Chief Technologist Ashkan Soltani, now a researcher, supported a private right of action with a period to cure.

Sen. Jerry Moran, R-Kan., asked how Congress can find common ground on a private right of action. Ohlhausen said there’s room for agreement, as long as the legislation doesn’t invite abusive litigation. She agreed the Federal Privacy Act could be a model.

If Congress doesn’t pass privacy legislation, pumping $1 billion into the agency would be a waste of money on unsuccessful agency litigation, and it wouldn’t protect consumers in any way, said Sen. Deb Fischer, R-Neb. Sen. Mike Lee, R-Utah, said he doesn’t believe the U.S. has $1 billion to fund the FTC further, and a new privacy bureau might create enforcement conflicts with the Consumer Protection Bureau.

Ohlhausen said the agency needs more resources and more statutory authority. A new privacy bureau would allow the agency to target several companies at once, instead of focusing investigations on one or two, said Soltani.

Congress shouldn't relinquish its responsibility to pass legislation by expanding the FTC’s bureaucracy, said Senate Minority Whip John Thune, R-S.D. All panelists but Soltani said they support a federal, preemptive privacy law. States should be able to go further, said Soltani.

There has been good indication the FTC is prepared to start a privacy rulemaking (see 2107280061), said Sen. Richard Blumenthal, D-Conn. He welcomed a rulemaking, noting his letter with colleagues asking for an FTC rule (see 2109200054). Ohlhausen said she doesn’t believe the agency has the necessary authority to initiate an effective privacy rulemaking, saying it likely wouldn’t preempt state laws. Congress should decide the new privacy law, but an agency proceeding is an option, said Vladeck. He disagreed with Ohlhausen about an FTC rulemaking not preempting state law.

Meanwhile, the whistleblower who provided details about Instagram’s impact on teen mental health will testify before the Senate Consumer Protection Subcommittee on Tuesday, the committee announced (see 2109270051). The hearing is at 10 a.m. in 253 Russell.