Rep. Suzan DelBene (D-WA) has introduced a comprehensive consumer privacy measure that would not cover employment data, does not include a private right of action, and would preempt states from making similar laws in most cases. HR Policy has been actively lobbying Congress to exclude employment data from any new privacy measure.
The Information Transparency & Personal Data Control Act’s broad exclusion of employment data is a welcome feature. In a call with journalists, Rep. DelBene noted, “I purposely wanted to focus just on the consumer data privacy side so we could get that through and be foundational.”
The measure does not include a private right of action. Instead, the Federal Trade Commission would be provided resources to promulgate regulations and enforce the bill’s provisions. State attorneys general would be allowed to pursue cases under the Act if the FTC declines to do so.
The bill preempts state and local laws except in certain areas, including requiring notifications after a data breach and providing protections around biometric data. “I understand why states are moving forward in the absence of the federal government moving, but I think it is much better to have a federal law versus a patchwork of laws from a consumer standpoint, but also from the standpoint of a small business,” DelBene said in an interview.
Under the bill, companies would be required to develop a privacy policy, allow users to opt in and out of certain uses of personal data, and submit to a privacy audit, among other mandates.
Looking ahead: Rep. DelBene, a former Microsoft executive, is hopeful that her bill will attract bipartisan support and gain momentum in the House. Thus far, the bill has 15 Democratic cosponsors and no Republicans. The bill’s carve-outs on preemption introduce what may be an attractive compromise for certain lawmakers, and may be imitated in other legislative efforts, which may not be far off.
