Rodgers and Cantwell Release Privacy Draft Discussion Bill

The House Commerce Committee plans to mark up a bipartisan, bicameral privacy bill this month, Chair Cathy McMorris Rodgers, R-Wash., announced Sunday in a draft bill agreement with Senate Commerce Committee Chair Maria Cantwell, D-Wash.

The American Privacy Rights Act, which Rodgers and Cantwell introduced as a draft discussion, would preempt state privacy law. It includes a private right of action for individuals to sue companies and allows consumers to opt out of targeted advertising. A federal privacy law must include a private right of action, said Cantwell, who declined to support the House Commerce Committee’s previous privacy bill (see 2207210056).

Senate Commerce Committee ranking member Ted Cruz, R-Texas, issued a statement Monday suggesting he won't support a private right of action: “I cannot support any data privacy bill that empowers trial lawyers, strengthens Big Tech by imposing crushing new regulatory costs on upstart competitors or gives unprecedented power to the FTC to become referees of internet speech” and diversity, equity and inclusion compliance, he said in a statement. Cruz said he will carefully review the bill, which he expects the committee to consider through regular order.

“A federal data privacy law must do two things: it must make privacy a consumer right, and it must give consumers the ability to enforce that right,” said Cantwell. Rodgers thanked Cantwell for her collaboration and said she looks “forward to moving the bill through regular order on Energy and Commerce this month.”

The FTC and state attorneys general would be granted authority to enforce the new law. Maryland passed comprehensive privacy legislation on Monday (see 2404080059). It would become the 17th state to enact a comprehensive privacy law if Gov. Wes Moore (D) signs the bill.

The federal proposal includes data minimization requirements for companies, allows consumers to block the transfer or sale of their data, requires affirmative consent for the third-party transfer of sensitive data and prohibits companies from “using people’s personal information to discriminate against them.” Consumers would be given the right to opt out of algorithmic decision-making related to “housing, employment, healthcare, credit opportunities, education, insurance, or access to places of public accommodation.” Companies would be required to conduct annual algorithm reviews, including examination of online kids’ safety and discrimination.

Rodgers and Cantwell have issued a “strong discussion draft,” House Commerce Committee ranking member Frank Pallone, D-N.J., said in a statement Sunday. The bill can be strengthened in “key areas,” he said, highlighting the need to improve children’s privacy measures.

The discussion draft shows “significant forward momentum” and builds on progress the House Consumer Protection Subcommittee made in the 117th Congress, said subcommittee ranking member Jan Schakowsky, D-Ill., in a statement Monday: “The American people have waited long enough -- now is the moment to ensure our constituents have the rights and protections they deserve. I look forward to Committee consideration of this proposal, including debate on how to improve and further strengthen its provisions and ensure all Americans’ data is protected.”

The proposal from Rodgers and Cantwell is a “good deal,” Microsoft President Brad Smith said. U.S. consumers “have long deserved clear, strong, and comprehensive privacy protections,” he said, and Microsoft looks forward to working with the committees to advance the bill.

Lawmakers know a national privacy law is needed to move forward with AI regulation, said Center for Democracy & Technology Vice President-Policy Samir Jain during a panel discussion that the International Association of Privacy Professionals hosted. With Rodgers retiring from Congress, this is her last chance to “cement a legacy” on privacy, he said. Keir Lamont, Future of Privacy Forum director-U.S. legislation, noted there’s more time to deliberate over the proposal than the previous bill, the American Data Privacy and Protection Act, which was introduced in June 2022, about six months before the end of the 117th Congress.