On Sunday, Energy and Commerce Committee (E&C) Chair Cathy McMorris Rodgers (R-WA) and Senate Commerce Committee Chair Maria Cantwell (D-WA) released a discussion draft of legislation entitled “The American Privacy Rights Act (APRA) of 2024.” This bipartisan legislative draft represents a long-sought (and elusive) comprehensive national standard for protecting the data privacy rights of Americans. Information on the discussion draft including a one-page background document, a section-by-section summary, and the bill text is attached for your convenience.
It is notable that Ranking Members Frank Pallone (D-NJ) and Ted Cruz (R-TX) were not party to the agreement. Rep. Pallone has indicated his general support for the bill but noted that “there are some key areas where I think we can strengthen the bill, especially children’s privacy.” Sen. Cruz, on the other hand, released a statement today indicating that while he will review the draft text carefully, he will not support any data privacy bill that “empowers trial lawyers, strengthens Big Tech by imposing crushing new regulatory costs on upstart competitors, or gives unprecedented power to the FTC to become referees of internet speech and DEI compliance.” Cruz also called on any privacy bill to go through regular order in the Commerce Committee, including hearings and markup.
Echoing Pallone’s concern about children’s privacy, Reps. Tim Walberg (R-MI) and Kathy Castor (D-FL) will introduce legislation this week updating the Children’s Online Privacy Protection Act, “COPPA 2.0.” The Walberg/Castor bill will likely mirror the Senate version (S.1418) introduced by Sens. Ed Markey (D-MA) and Bill Cassidy (R-LA). In addition, we are told that Rep. Gus Bilirakis (R-FL) intends to introduce the House version of the Kids Online Safety Act (S.1409), which was introduced by Sen. Richard Blumenthal (D-CT) and has 65 co-sponsors. Both bills were reported out of the Senate Commerce Committee in July of 2023.
Timing
The Energy and Commerce Committee has provided no details on the timing for consideration of APRA but Chair Rodgers has indicated that she intends the committee to follow regular order (i.e., subcommittee and/or full committee hearing(s) and markup(s) and ultimately, consideration on the House floor). E&C’s aspirational goal is to have the bill pass the House before the Memorial Day recess begins on May 24. This would allow ample opportunity for Members to amend the bill to address any concerns; however, such an aggressive timeline assumes that very challenging policy (and jurisdictional) disagreements could be resolved in an unusually expeditious manner. Thus, the timeline could very easily slip.
Meanwhile, the Senate process is less clear. While the Commerce Committee has advanced privacy bills aimed at protecting children, no movement has occurred since the committee markup on July 27, 2023. Other narrowly tailored House bills are within the Committee’s jurisdiction but have yet to move, including: the “TikTok bill” (H.R. 7421), which passed the House on March 13 with a vote of 352-65; and legislation to prohibit data brokers from selling personal information to foreign adversaries (H.R. 7520), which passed the House on March 20 with 414 votes. Chair Cantwell has indicated she would like to hold hearings on these two bills in the near future. Resolving the policy differences with the newly-drafted comprehensive data privacy bill and determining how these smaller individual bills factor into the equation will be very complicated and take time.
Jurisdiction Issues
While ARPA was drafted solely within the jurisdiction of E&C, other committees have indicated they are interested in shaping any comprehensive data privacy legislation that might move this Congress. In fact, the House Financial Services Committee (HFSC), under the direction of Chairman Patrick McHenry (R-NC), was the first House committee to act on privacy this Congress. McHenry introduced the Financial Services Modernization Amendments Acts of 2023 (H.R. 1165) in February of 2023, a data privacy bill focused on the use and collection of data by financial institutions. The bill was marked up on February 28, 2023, and passed by a partisan vote of 26-21. No further action has been taken on the bill since the mark-up but the point was clear-HFSC asserting its jurisdiction and officially planting its own legislative flag.
In response to the E&C/Commerce discussion draft, Chairman McHenry has made clear that he believes the legislation has an impact on issues within his jurisdiction and, as such, will seek to incorporate provisions of his bill before ARPA can be brought to the floor. Other committees-most notably the House Judiciary Committee-may be interested in seeking changes to the bill.
Key Provisions
Previous versions of the comprehensive data privacy legislation have included provisions that were controversial and the subject to much discussion in Congress, including: a federal preemption of state laws, enforcement provisions such as the private right of action, exemptions for specific industries, and the extent of consumer rights.
- Federal Preemption. The draft includes a federal preemption provision but notably provides an exception for an extensive list of state laws. This provision will likely be the subject of several amendments if the legislation is marked up in E&C or subject to amendment on the House floor.
- Enforcement Provisions. The bill vests enforcement with the Federal Trade Commission (FTC) and directs the agency to establish a new bureau comparable to the Bureaus of Enforcement and Competition to carry out its authority under this act. In addition, the legislation authorizes enforcement by State attorneys general, and most controversially, enforcement by individuals through a private right of action. There will be interest in revising or eliminating this provision if the bill moves through a regular order process.
OUTLOOK/ANALYSIS. At this point, bicameral Leadership is still digesting the draft and not ready to make any commitments as to process or the overall prospects of legislation moving. In fact, they were left somewhat in the dark and did not have advance notice of the forthcoming draft.
That said, all things privacy-especially as it relates either tangentially or directly to China-can catch legislative fire at any given moment as was witnessed with the House’s 10-day process in moving TikTok divestment legislation. As such, this bipartisan and bicameral draft should be treated seriously and is likely to garner more Member input and potentially become a lawmaking exercise.
###