Legislators on both sides of the aisle have been looking to pass comprehensive federal privacy legislation for several years now. Despite this bipartisan appetite, historically, producing passable legislation has proven impossible due to significant disagreements amongst Republicans and Democrats regarding key issues, namely, state law preemption and private right of action. However, recently, the American Data Privacy Protection Act (ADPPA) (H.R.8152) has provided privacy advocates with arguably the strongest possibility of enacting a national privacy schema to date. Significantly, the legislation, introduced on June 21, 2022, is cosponsored by both the Chairman and Ranking Member of the committee of jurisdiction, the House Energy and Commerce Committee. Chairman Frank Pallone (D-NJ) and Ranking Member Cathy McMorris Rodgers (R-WA) are both long-time leaders of the privacy debate who have previously introduced their own partisan privacy legislation and proved unable to compromise. These previously irreconcilable differences have largely centered around state law preemption and private right of action. The ADPPA employs innovative compromises to both.
State Law Preemption. With regards to state law preemption, reflecting long-time Republican priorities, the ADPPA would preempt most elements of current state privacy laws. However, in a compromise with Democrats, the ADPPA contains a “state law preservation” provision, stipulating the law would not preempt (1) generally applicable consumer protection laws; (2) civil rights laws; (3) laws governing employee privacy rights; (4) data breach notification laws; (5) contract or tort law; (6) criminal laws predominately relating to theft or fraud or cyberstalking, bullying, or sexual harrassment; (7) public safety or sector specific laws unrelated to privacy or security; (8) laws relating to public justice and criminal justice information systems; (9) laws addressing financial information or social security numbers; (10) laws relating solely to facial recognition or surveillance; (11) Illinois’ Biometric Information Privacy Act and Genetic Information Privacy Act; (12) laws relating to unsolicited email or telephone solicitation and caller ID; (13) laws that address the confidentiality of library records; and (14) §1798.150 of the California Civil Code. Additionally, the legislation does not preempt common law or statutory causes of action for civil relief; it just bars an ADPPA violation from being included as an element in any such action.
California Objections. While this significant carve out appears to satisfy most Democrats, two California members of the House Energy and Commerce Committee voted against the bill when it went up for a committee vote, claiming it has significant loopholes. For example, committee member Representative Anna Eshoo (D-CA) claimed the bill contains a concerning loophole that would allow law enforcement officers to access the private data of individuals seeking abortions. Additionally, over the past few months, the California Privacy Protection Agency (the Agency) released several statements expressing its dissatisfaction with the bill’s preemption provisions. In a letter to Speaker Nancy Pelosi (D-CA) and House Minority Leader Kevin McCarthy (R-CA), the Agency claimed the ADPPA threatens to undermine California’s privacy regime and effectively render the entire agency unable to carry out its functions. For example, the ADPPA would eliminate the “floor” on privacy rights instituted by the California Privacy Rights Act (CPRA) that allows the state legislature to modify the California Privacy Protection Act (CPPA) only in ways consistent with its original purpose and intent. Additionally, the Agency would no longer be able to effectively carry out its mandate to enforce California privacy laws since California’slegislation would almost completely be preempted by the federal legislation. California Governor Gavin Newsom has also echoed the Agency’s concerns.
ADPPA advocates must give weight to the Agency’s objections because the agency has Speaker Pelosi’s support, as demonstrated by her September 1 press release. In the statement, Speaker Pelosi said she will not hold a vote on the legislation in the Senate because it does not adequately emulate California’s privacy protections. She intends to work with Chairman Pallone to address the objections. Significantly, the legislation does not preempt the CPPA’s private right of action provision, which many Democrats count as a sizable victory given Republicans’ qualms with allowing a private right of action. However, Democrats have long advocated for federal privacy legislation that institutes a minimum privacy protection regime, but allows states to institute stricter privacy laws as they see fit. This compromise significantly undermines that vision, and it is unclear if Democrats will be able to ultimately rally around the ADPPA as written. However, chipping away at the preemption provisions may lead to diminished Republican support.
Private Right of Action. Under the ADPPA, beginning four years after the bill’s enactment, any individual who suffers an injury as a result of a violation of the law may bring a civil action against the violating entity in federal court. Limitations include (1) that the individual must first notify the FTC and their state attorney general outlining their desire to commence a civil action and provide them both with 60 days to determine whether they will independently intervene; (2) prior to commencing a suit for injunctive relief or against a medium-sized or small business, the prospective defendant has a “right to cure” – namely 45 days to address the alleged infraction to avoid the suit; and (3) a prohibition on pre-dispute arbitration agreements or joint-action waivers in cases regarding minors. Additionally, individuals cannot sue for statutory damages. These stipulations exhibit compromises bowing to Republican concerns about a potential landslide of frivolous lawsuits if a private right of action is allowed.
Further Challenges Ahead. In addition to California legislators’ opposition, the ADPPA faces additional challenges in the Senate. Namely, it does not have a chief senatorial advocate to push for its passage through the chamber. Senator Maria Cantwell (D-WA), Chairwoman of the Senate Commerce, Science, and Transportation Committee, the Senate committee of jurisdiction, remains a stubborn holdout. Like Reps. Pallone and McMorris Rodgers in the House, Sen. Cantwell has been a longtime leader in the privacy space, alongside the Commerce Committee’s Ranking Member Senator Roger Wicker (R-MS) from the Republican cohort. In comparing the ADPPA to Sen. Cantwell’s previously introduced privacy legislation, the Consumer Online Privacy Rights Act (COPRA) (S.3195 in the 117th Congress) the two bills are largely compatible, albeit several of their key definitions are marginally different, such as that for service provider, small business, covered entity, and covered data.
However, Sen. Cantwell’s main concerns do not seem to stem from these differences, but rather from the ADPPA’s enforcement provisions, characterizing them as too weak. Additionally, in the wake of Dobbs v. Jackson Women’s Health Organization, Sen. Cantwell has focused her privacy agenda on protecting women’s access to abortion care, characterizing it as a right to privacy. For example, after the leaked draft Dobbs opinion, the Senator cosponsored the My Body, My Data Act (S.4434). The bill would provide added protections for sensitive health data, particularly that pertaining to reproductive and sexual health information. If enacted, the bill would preempt state laws to the “extent they conflict” with the legislation. However, the preemption issue will likely never be at the forefront of the debate over the bill, as it currently only has Democratic support and is unlikely to gain many – if any – Republican cosponsors given the current political climate.
With that said, whether she will join Rep. Eshoo in voicing additional concerns with the ADPPA specifically connected to abortion access remains to be seen. However, if her support for the bill becomes contingent on its protection of abortion access, it will almost undoubtedly lose significant Republican support and any chance of passing.
Other key legislators, such as ADPPA cosponsor and Energy and Commerce Committee member Representative Jan Schakowsky (D-IL), have expressed frustration with Sen. Cantwell’s trepidation. Notably, Sen. Wicker voiced his support for the bill in a July 27 Senate Commerce Committee hearing, stating that while “no legislation is perfect” the ADPPA presents the best possible chance of getting bipartisan legislation on the President’s desk by the end of the year.