Privacy Advocates Divided on Potential Legislation

WASHINGTON — Data privacy is getting its turn in the spotlight this week as the bipartisan American Data Privacy and Protection Act passed out of the House Energy and Commerce Committee with wide agreement in a 53-2 vote.

“It’s the most progress we’ve seen on data privacy in 20 years in Congress,” said Caitriona Fitzgerald, the deputy director at the Electronic Privacy Information Center, in an interview Friday.

It’s not the law Fitzgerald would write, but “it’s a very good start to that path,” she said. 

Movement on the law shows Congress realizes the country has reached a “crisis point of tech companies hoarding our data and using it in whatever ways they please, and we need to put limits on that,” Fitzgerald said.

Others, including the Electronic Frontier Foundation, are worried that the potential legislation misses the mark.

“EFF is disappointed by the latest draft of the American Data Privacy Protection Act,” the organization tweeted Wednesday. It listed objections including language that could override states’ more aggressive data privacy laws already in place and how the law makes many exceptions for people to sue companies found to have violated their privacy.

The day before the law passed, 10 state attorneys general sent a letter to the committee urging it “to ensure such legislation does not undermine protections that states have already established.”

They give examples of consumer-protection laws like the Health Insurance Portability and Accountability Act, which when bolstered by state laws like California’s Confidentiality of Medical Information Act was used to extend medical data protections from doctors to applications that keep medical data.

“We welcome a federal partner with the tools and resources for vigorous enforcement of new consumer rights. But it is critical that Congress set a federal privacy-protection floor, rather than a ceiling, to continue to allow the states to innovate to regulate data privacy and protect our residents,” the state attorneys general wrote.

But overall, the law at its core is a win because it “takes the onus off consumers from reading these policies and puts the onus on the companies” creating them, Fitzgerald said.

Companies will be required to only collect data that is “reasonably necessary to provide the service,” she explained.

That fundamentally shifts the data economy if this legislation comes to pass, she said.

Currently, companies are collecting vast amounts of data that they can either use or sell, she said. But if this law passes, the average person “can be more confident when using apps, [and] visiting various websites, that their personal data isn’t being used in ways that they don’t expect,” Fitzgerald said.

The civil rights protections in the bill are also important, especially when it comes to digital advertising for jobs and homes, she said.

“Right now it is difficult to bring cases on [online advertising discrimination] because our civil rights protections don’t protect us online. There shouldn’t be a difference if it’s a brick and mortar or online, and this bill corrects that,” Fitzgerald said.

This is hopefully the beginning of realizing data privacy is an important bipartisan issue that needs to be tackled by a variety of legislation, she said, adding just this week the House Judiciary Committee held a hearing about the data dragnet created by law enforcement purchasing digital data. 

Buying the data is seen by privacy advocates like Fitzgerald as a workaround for the Fourth Amendment that says “no warrants shall issue, but upon probable cause.”

In both chambers the respective Judiciary Committees are working on the Fourth Amendment Is Not For Sale Act, which would limit law enforcement’s warrantless access to this data.

Now is the time to take the first step in data privacy and build on it later, Fitzgerald said. 

“Every week there’s another story about our data being abused in different ways, and folks have realized things need to change,” she said. “The harms are just too dangerous and it’s happening too frequently.”

Madeline can be reached at [email protected] and @MadelineHughes