On Wednesday the U.S. House Commerce Committee voted 53-2 to send a bipartisan data privacy bill to the entire House. The bill (H.R. 8152), entitled the American Data Privacy and Protection Act, would accomplish not only the important objective of having a national standard for protection of Individuals’ privacy rights, but also the important objective of giving businesses a reprieve of sorts with regard to their data privacy compliance efforts by preempting more restrictive state laws. The two lone negative votes were from two California legislators (recall that California was the first state to pass a comprehensive privacy law – the California Consumer Privacy Act (CCPA)). The bill in its present form is not without critics, but the legislators favoring the bill are optimistic that it could be signed (likely with some amendments) by the President by year end.
The stated purpose of the legislation is to “provide consumers with foundational data privacy rights, create strong oversight mechanisms, and establish meaningful enforcement.” The law would apply to most entities, including both for profit and not for profit, and would apply to information that identifies or is reasonably linkable to an individual. It also would require covered entities to adopt data security practices and procedures that are reasonable in light of their size and activities. As proposed there would be some relief for small and medium sized businesses (to be defined) from compliance with certain requirements. Among other things, the new federal law would provide individuals with certain rights, such as the right to access, correct and delete their personal information, and provide a framework to minimize the collection of personal information that is not necessary to the provision of goods and services The bill also provides certain rights of individuals with regard to sharing of their personal information. Another key aspect of the proposed law (and one that has been a sticking point), is the provision for private rights of actions by individuals (rather than by governmental authorities only).
If the overwhelming support for the legislation in the House Commerce Committee is any indication of the likelihood of success, a new federal data privacy law (albeit with some likely amendments) could be here before we know it.