The Senate Commerce Committee held its first privacy hearing of the 117th Congress, with more to follow. The hearing, which did not explicitly cover HR data, illustrated that certain members are looking to increase regulatory enforcement, raising questions about whether HR data would be implicated.
Regulatory approach could cover HR data: Most privacy bills thus far have proposed enforcement by some mix of beefing up the Federal Trade Commission, giving state attorneys general jurisdiction, and/or establishing a private right of action. However, giving the FTC or some new agency broad authority to propagate regulations could implicate HR data, especially in the absence of clear and comprehensive statutory language exempting such data.
Several leading data privacy bills contain provisions creating new regulatory authorities or bolstering the FTC:
- Senate Commerce Committee Chair Maria Cantwell’s (D-WA) Consumer Online Privacy Rights Act (S. 2968) would create a new bureau within the FTC to enforce the Act’s provisions, including promulgating new regulations. The Act excludes HR data, but several significant ambiguities within the bill call into question the scope of the exclusion. Sen. Cantwell has not yet reintroduced the measure but is expected to reintroduce some version this Congress.
- Sen. Kirsten Gillibrand’s (D-NY) Data Protection Act of 2021 (S. 2134) would create an independent federal privacy regulator with significant enforcement authority. The bill covers employment data.
- Senate Commerce Ranking Member Roger Wicker’s SAFE DATA Act (S. 2499) would appropriate the FTC $100 million to enforce the measure. The SAFE DATA Act does not cover HR data in most cases.
The morning after the hearing, the Washington Post ran an editorial supporting legislative action establishing comprehensive consumer data privacy reform rather than relying on regulation and enforcement by the FTC.
What comes next: Legislators are likely eyeing 2022 to restart the privacy conversation in earnest. As recently as early 2020, Democratic and Republican bills demonstrated striking similarities over the vast majority of their provisions. Now, some key Republicans are signaling an easing of tensions regarding at least one of the two major sticking points—the availability of private lawsuits. If an agreement can be reached through increased FTC funding and/or the creation of a new enforcement bureau within the FTC, establishing a clear and comprehensive exclusion of HR data within legislation will become more pressing.
