‘Bill Could Threaten Californians:’ States Retaliate as the Federal Privacy Bill Advances

A bipartisan bill to give Americans more control over their data has progressed further than any before it. The bill has now advanced to the House Committee on Energy and Commerce, passing by a vote of 53-2 and is now eligible for a full House floor vote, following discussions that begin end of July. The bill, American Data Privacy and Protection Act (ADPPA), moved forward with certain amendments, but industry stakeholders are concerned over access to data troves which could leave brands grappling to reach new customers. Meanwhile, issues over preempting state privacy laws spark debate between political parties that could potentially stall the advancement of the bill. “It is the furthest that any federal privacy bill has ever gotten,” said Jami Vibbert, privacy and cyber partner at law firm Arnold & Porter. “But I'm still not convinced that it's going to make it through.” A case of California vs. Congress Among the significant amendments, the bill included how the California Privacy Protection Agency (CPPA) now has the right to enforce ADPPA in the state. ‘Doing the Bare Minimum:’ Google Proposes Rival Payment Methods for Android Developers in EU This change comes after the CPPA elicited earlier this month that having no authority to enforce the federal privacy law within the state compromised Californian’s current privacy protections. California’s privacy law puts more constraints on businesses than the federal bill. Enforcing the federal law could undermine California's stricter laws that currently provide more protection to peoples' data. “This was to provide some assurance to the California constituents that the federal law wasn't going to significantly hurt their privacy protections,” said Vibbert. “I'm not sure this is going to be enough.” “I’m concerned that the bill before us would threaten California’s privacy rights and protections,” said Rep. Anna Eshoo (D., Calif.) at yesterday's markup session to discuss the bill. Previously, top democratic senators have cast their doubt on the bill. Senate Commerce Chair Maria Cantwell (D-Wash.), whose panel decides on any data privacy bill, has cited concerns that the legislation is too weak to warrant passing a federal law that overrides state privacy laws, like the CPPA. This debate has led to contention between Democrats, who are hesitant to preempt state measures, and Republicans, who worry about the patchwork of statewide laws making compliance difficult for businesses. Targeting the advertising industry The amendment included expanding on the definition of sensitive data. It now includes color, race, religion, union membership and internet browsing history over time and across third-party websites or online services. “There is not a privacy law on the globe that goes that far as to qualify internet browsing history as sensitive data,” said Vibbert. It comes as a “global effort to target and change the way that the advertising industry works.” Meanwhile, the bill shortened the grace period for the private right of action, a feature that lets people sue data security breaches, from four years to two years. That means businesses can now be sued two years after the bill becomes law. This could come as a blow to big tech, ultimately resulting in costly litigations, as previously voiced by trade organizations. Meanwhile, privacy advocates stand in favor of the private right to action. However, small businesses—with annual revenue of less than $25 million, that engage with data of less than 50,000 people, and earn less than half of their revenue from transferring covered data—are now exempt from this provision. Curtailing data access limits reach The ADPPA still limits how big tech can collect, process and transfer data within constraints that are only necessary to provide their services. That, unsurprisingly, has given trade bodies representing the online ad industry cause to take umbrage with the bill. “Not only advertising companies, but anyone depending on data to succeed in today’s economy, will encounter a less friendly online environment,” said Lartease Tiffith, evp of public policy, IAB. “IAB has been advocating for significant improvements to this bill and cannot support it as it currently stands.” Per the bill, people still have the right to access, correct, delete and export data. But the bill prohibits the transfer of sensitive information such as geolocation or biometric data or restricts it to limited circumstances. People can also opt out of targeted advertising and transfer covered data to a third party. Lastly, the bill still bans targeted ads to children under 17 years. “The advertising ecosystem is facing more headwinds around the use of identity signals than ever before," said Field Garthwaite, CEO, IRIS.TV. "ADPPA is going to further eliminate existing data processes which is going to lead to the decline and availability of identity data to engage with consumers. Today, this underpins billions of ad dollars transacted in the open ad-supported marketplace. Brands will have a much harder time reaching consumers than ever before.”