Privacy & Information Security Law Blog

Reporting from Washington, D.C., Hunton & Williams partner Frederick Eames writes:

Elections have consequences. What are the consequences of the 2012 election on U.S. federal privacy, data security and breach notice legislation? We outline some key developments in the U.S. House of Representatives and Senate and explain how these developments might affect legislative priorities and prospects for the 113th Congress beginning in 2013.

U.S. House of Representatives

Three committees in the U.S. House of Representatives have jurisdictional claims to privacy, data security and breach notice legislation: Energy & Commerce, Financial Services and Judiciary. Over the years, the Energy & Commerce Committee has been by far the most active on these issues, and we expect that to continue to be the case.

Representative Mary Bono Mack (R-CA) has chaired the Energy & Commerce Committee’s Subcommittee on Commerce, Manufacturing and Trade for the past two years and has been a strong proponent of data security and breach notice legislation. However, Representative Bono Mack lost her re-election bid. The other Republican on the Committee most involved with these issues, Representative Cliff Stearns (R-FL), lost in the primary election earlier this year. Representative Stearns has chaired the Committee’s Subcommittee on Oversight and Investigations. Next in seniority on the Committee is Representative Lee Terry (R-NE), followed by Representatives Tim Murphy (R-PA), Marsha Blackburn (R-TN) and Michael Burgess (R-TX). It is unclear how full Committee Chairman Fred Upton (R-MI) will allocate the subcommittee chairmanship assignments. Either way, whoever chairs the Subcommittee next year likely will have an outlook favorable to industry positions on data security and breach notice legislation. It is less clear whether such legislation will continue to be a priority, though it does have bipartisan support. We do not expect the Committee to take up comprehensive privacy legislation, but we would not rule out a review of specific industry practices that have garnered media attention, such as behavioral advertising or the efficacy of industry opt-out and self-regulatory structures. The Energy & Commerce Committee has jurisdiction over the Federal Trade Commission and could be prompted to exercise oversight should the FTC’s privacy-related agenda become more aggressive.

On the Financial Services Committee, both the chairman and the ranking Democrat are set to change. We expect Representative Jeb Hensarling (R-TX) to replace Representative Spencer Bachus (R-AL) as Committee Chairman, and Representative Maxine Waters (D-CA) to take Representative Barney Frank’s (D-MA) slot as Ranking Minority Member. While Representatives Bachus and Frank were far apart ideologically, it would be hard to imagine two members further apart than Representatives Hensarling and Waters on substance or in temperament. A place where the Committee’s jurisdiction could be exercised is in attempting to rein in regulatory expansions brought about by the Dodd-Frank Act, including the ramping up of the Consumer Financial Protection Bureau. President Obama’s victory and a slightly expanded Democratic majority in the Senate temper how effective such efforts may be.

Representative Bob Goodlatte (R-VA) appears to be in line to chair the House Judiciary Committee, as current Chairman Lamar Smith (R-TX) is term-limited. Representative John Conyers, Jr. (D-MI) is expected to continue as ranking Democrat.

U.S. Senate

Like the House, three Senate committees have exercised jurisdiction over privacy, data security and breach notice legislation: Banking, Housing, and Urban Affairs; Commerce, Science and Transportation; and Judiciary. Of note, we expect that some committee ratios will change in the next Congress, reflecting that there will be two more Democrats and two fewer Republicans in the body. The Banking, Housing, and Urban Affairs and Judiciary Committees currently have two more Democrats than Republicans, but the Commerce, Science and Transportation Committee has only one.

The Banking, Housing, and Urban Affairs Committee has been the quietest of the three committees in recent years on data security and privacy issues, and has been less active in passing legislation than in raising jurisdictional issues as the other committees have attempted to move legislation to the Senate floor (a fact cheered by many in industry). We do not expect a significant change in this dynamic. Chairman Tim Johnson (D-SD) is expected to retain his position. The ranking Republican will be Senator Mike Crapo (R-ID), taking over for term-limited Senator Richard Shelby (R-AL). Expect Democrats to make room on the Committee for Senator-elect Elizabeth Warren (D-MA), who rose to political prominence proposing tighter bank regulation and consumer financial regulation.

The Commerce, Science and Transportation Committee has been the most active jurisdiction on data security and privacy issues. It is clear that under Chairman Jay Rockefeller (D-WV), that will continue. In October, Rockefeller wrote to nine companies that use and sell consumer data, under the Committee’s investigative authority, asking from whom they buy and to whom they sell data. That investigation will continue into 2013. Rockefeller’s Committee was not able to pass data security and breach notice legislation during this Congress, which was a source of some frustration to the Chairman. In early 2011, Senator John Kerry assembled a privacy bill, but that initiative never attracted enough support to grow into an effort involving the full Committee. With the Obama Administration earning four more years at the polls, signaling a strong continued focus on privacy issues by the FTC and Department of Commerce, we expect that the Commerce, Science and Transportation Committee will, at a minimum, reinforce and amplify that focus, though its adoption of comprehensive privacy legislation still seems a remote possibility. The Committee will have a new ranking Republican, Senator Jim DeMint (R-SC), who ran his own market research company prior to being elected to Congress.

The Judiciary Committee is the only Senate committee in the 112th Congress to have passed data security and breach notice legislation. No major changes in the Committee’s leadership are expected: Chairman Patrick Leahy (D-VT) and ranking Republican Chuck Grassley (R-IA) are expected to remain in their posts.