Privacy & Information Security Law Blog

On June 23, 2022, the U.S. House of Representatives Subcommittee on Consumer Protection and Commerce passed by voice vote H.R. 8152, the American Data Privacy and Protection Act (“ADPPA”). This bipartisan legislation, sponsored by House Energy and Commerce Committee Chairman Frank Pallone (D-NJ), committee Ranking Republican Cathy McMorris Rodgers (R-WA), subcommittee Chairman Jan Schakowsky (D-IL) and subcommittee Ranking Republican Gus Bilirakis (R-FL), is based on the bipartisan, bicameral “Three Corners” draft bill released on June 2, 2022 with the support of Pallone, Rodgers and Senate Commerce Committee Ranking Republican Roger Wicker (R-MS). 

While many more steps remain in the legislative process before the bill could be enacted, the vote marks the furthest progress that any comprehensive federal privacy legislation has made in all the years Congress has considered such legislation. Privacy legislation previously had appeared to be a relatively low priority for this Congress, with few hearings and seemingly continued stalemate on key issues. The release several weeks ago of the Three Corners draft changed that, and has touched off a flurry of lobbying activity in Washington.

Observers have noted for some time that comprehensive privacy bills sponsored by Democrats and Republicans have contained a number of common elements. Key issues separating the parties appeared to be preemption of state laws and enforcement by individuals, known as a private right of action (“PRA”). Many businesses and business groups, desiring a single national standard over the possibility of an increasing number of differing and potentially conflicting state privacy requirements, have identified federal preemption of state laws as their key reason to push for a federal law. Businesses generally have been opposed to including a PRA in a federal bill, out of concern that a federal law with a host of obligations and terms open to interpretation could lead to a flood of lawsuits, a “sue and settle” environment that could overwhelm small businesses in particular. Others have been willing to negotiate on that issue, so long as the PRA includes limitations applying it only to actual harm that would not otherwise be redressed.

At the June 23, 2022 committee meeting, only one amendment was adopted to the bill – an amendment in nature of a substitute making a number of improvements agreed upon by the bill’s Democrat and Republican sponsors. Several other amendments were offered and withdrawn, including amendments addressing both the preemption and the PRA provisions in the bill:

• Rep. Debbie Lesko (R-AZ) offered and withdrew an amendment to provisions in the bill requiring that large data holders conduct an impact assessment of any algorithms they apply to covered data. The bill would require such entities to describe steps they have taken to mitigate various harms, including disparate impacts on the basis of race, color, religion, national origin, sex or disability status. Lesko’s amendment would have added “viewpoint” to that list of bases.
• Rep. Kelly Armstrong (R-ND) offered and withdrew three amendments:
  • Striking and replacing the preemption section.  Armstrong argued that the preemption language – which contains a number of exceptions, including some that are open to significant interpretation as to scope – is likely to be limited by future court decisions. Armstrong argued that, where Congress only partially preempts the states, courts will attempt to harmonize state laws with the federal law, rather than find that the state law is preempted;
  • Amending the PRA in the bill so that, where the Federal Trade Commission or a state attorney general files suit for a violation of the statute, there is no PRA for the same matter. As the bill now reads, a covered entity could be subject both to a PRA and government enforcement for the same issue;
  • Broadening the right of a covered entity to cure a violation of the Act.  At present under the bill, the right to cure applies only to certain issues, and only to small businesses. Armstrong argued that the right to cure should apply broadly, noting that California’s Attorney General touted that California’s right to cure resolved 75% of alleged violations before reaching a court.

It is common in a circumstance where members of Congress broadly want a bill to advance, as in this case, that they will employ tactics such as offering and withdrawing amendments, rather than pushing them to a vote. The process of offering the amendment often results in a commitment by a committee’s leadership — as it did in the case of the amendments above — to work further on resolving the issue before the next vote on the legislation, which in this case will be at the full Energy and Commerce Committee on a date yet to be determined.

Steps beyond consideration in the committee are uncertain. In the Senate, there is no bipartisan agreement among Senate Commerce Committee leaders around this bill as there is in the House. Commerce Committee Chairman Senator Maria Cantwell (D-WA) has a competing legislative draft and has raised numerous concerns with the House bill.