Momentum could shift on passing landmark privacy legislation

While a House committee has approved comprehensive privacy legislation, the prospects of passage by the full chamber and in the Senate are less certain. Instead, lawmakers may have to be satisfied with addressing further protections for children online.

Two of the three bills being discussed would bolster the Federal Trade Commission’s enforcement powers and create new divisions in the agency.

“You wouldn’t bet on Congress passing something this big given the disagreements and the political environment. But smaller bites could be more palatable,” said a lobbyist who works with industry groups and requested anonymity to speak more freely.

The American Data Privacy and Protection Act would require companies to collect the least amount of data possible, with special protections for children, and create a new privacy bureau at the FTC. It also punishes firms for using data in a discriminatory manner, including civil rights protections against biased uses of data.

The legislation has extensive preemption of state privacy laws that would weaken California’s first-in-the-nation, sole-purpose privacy regulator: the California Privacy Protection Agency. Recently, the state agency claimed such legislation sets a “ceiling” that prevents states from enacting and enforcing privacy laws in the future.

The bill further broadens the definition of “employee information,” which is exempt from the law. It also allows consumers to sue companies if they’re harmed by a security breach of their data — a so-called private right of action — two years after the law takes effect. Awards would be limited to compensatory damages, injunctive relief, and attorney’s fees. Consumers could only sue after notifying the FTC and their state attorney general’s office. According to the House bill, those entities would have 60 days to decide “whether they will independently seek to intervene in such action.”

The bill passed the committee 53-2, but it’s unclear when it will come up for a House vote. The chamber is in recess until Labor Day, and after that only has a few weeks in session until the Nov. 8 midterm elections. It could come up in a lame-duck session after the election.

Even if the House passes it, navigating the upper chamber will be a challenge.

Senate Commerce Committee Chair Maria Cantwell is opposed to the measure, as she doesn’t think it provides enough protection for consumers. She wants to exclude provisions that limit forced arbitration and wants to give consumers more latitude concerning private rights of action.

The Washington Democrat could kill the bill by refusing to take action, assuming the full House passes the measure, which was approved last month by the Energy and Commerce Committee.

It’s possible lawmakers could reach consensus on less wide-ranging bills.

Last month, the Senate Commerce Committee passed two bills on children’s privacy, both sponsored by political odd couples.

The Kids Online Safety Act, sponsored by Richard Blumenthal, a Connecticut Democrat, and Marsha Blackburn, a Tennessee Republican, would require companies to act in the best interest of users under 16. It would let children opt out of algorithmic recommendations and other potentially harmful features. Social media platforms would be required to conduct annual independent audits assessing risks to children.

The Children and Teens’ Online Privacy Protection Act — backed by Ed Markey, a Massachusetts Democrat, and Bill Cassidy, a Louisiana Republican — would expand privacy protections for teens. Markey is one of Congress’ top experts on the subject. While in the House, he sponsored the Children’s Online Privacy Protection Act.

The Markey-Cassidy bill would create an “eraser button” for parents and minors to delete personal information and forbid websites and apps from collecting sensitive data from teens between 13 and 15 without first obtaining their explicit consent.

It would also establish a Youth Marketing and Privacy Division at the FTC.

But several Republicans disagreed with giving the FTC additional powers, and that could be problematic for the measure as it works its way through the legislative process. All measures need 60 votes to pass in the Senate, so that means sponsors have to pick up nine additional Republicans in a chamber that’s evenly divided between the parties.

Concerned about giving the FTC more clout, Blackburn said the chamber needs to “make certain the FTC stays in their lane and does not overreach on the rulemaking authority.”

Republicans on Capitol Hill and some of their business allies are worried about what they view as Chair Lina Khan’s aggressive rulemaking plans on the privacy and antitrust fronts. Many in the conservative legal community argue the agency lacks the statutory authority to embark on this rulemaking.

Democrats have supported expanding the agency’s powers, yet it’s uncertain whether they’d relinquish the provision regarding the Youth Marketing and Privacy Division to increase chances of the legislation passing.

*Amy Miller and Mike Swift contributed to this story.