Industry Calls for More Specificity on Federal Privacy Bill

The bipartisan privacy proposal of the American Data Privacy and Protection Act (ADPPA) has rekindled conversations around the urgency of a federal framework to protect internet users. While broad contours of the bill are supported by tech trade groups and lawmakers, the devil is in the detail. Industry experts claim that aspects of the bill are woolly, which could lead to an undue burden on tech businesses. “Combination of unclear definitions with the availability of attorney’s fees seems like a recipe for a flood of lawsuits,” said John Miller, svp of policy and general counsel at Information Technology Industry Council. Here are some of the aspects of the bill lobbyists and trade organizations are looking for clarity on. What Advertisers Need to Know About the Federal Privacy Law Establishing a standard to preempt state laws The patchwork of state laws, each containing slightly different and sometimes contradictory obligations, has already cost the tech industry millions in terms of compliance. Whether the federal bill will override these state laws—something that is currently ambiguous—has concerned trade associations, including TechNet which represents hundreds of companies, who have expressed their woes in a letter, to Senators in Washington D.C. “The language of the bill's preemption provisions” reads the letter, “appears to allow [state] laws to continue to remain in effect so long as the complaint does not allege violations of the ADPPA.” The trade associations propose that congress establish a uniform standard where the state laws are preempted. Narrowing the scope of the private right of action The private right of action, a feature of California’s privacy law that lets people sue following data security breaches, is a blow for the tech industry and could make room for a wave of costly litigations, per the letter by trade organizations. To counter, the firms want more clearly defined rights for both people and businesses. Instead of giving people the right to file a class-action lawsuit, trade organizations ask to “remedy substantial privacy harms that are specific, individualized and tangible.” The U.S. Chamber of Commerce echoed this retaliation. “A national data protection law including a private right of action would encourage an influx of abusive class-action lawsuits, create further confusion regarding enforcement of blanket privacy rights, harm small businesses and hinder data-driven innovation,” they said in a statement. The current draft also provides the FTC with strong enforcement authority and empowers state attorney generals with similar rights. For this “it is reasonable to ask whether including a private right of action is necessary to ensure robust enforcement,” said Miller. However, David Brody, managing attorney for the Digital Justice Initiative at the Lawyers' Committee for Civil Rights Under Law, disagrees. “The FTC and state agencies may lack the resources or ability to address all concerns,” he said, “and that's why it's important for individuals to be able to go to court and seek relief.”. Fixing loose definitions Certain terms, like “targeted advertising” refer to showing ads to people online based on “knowns and assumptions derived from covered data collected," per the bill. Miller suggested bringing the definition more in line with the recent state privacy laws, which, according to him, strike the right balance to enable internet companies to reasonably advertise to people on their own sites, while protecting their privacy interests. “We have concerns that, as presently drafted, the definition of targeted advertising would prevent the ad-supported internet business model from continuing,” he said. The bill enforces data minimization and establishes companies to collect data that is “reasonably necessary," or what is truly needed by businesses. “[The term] 'need' is a hugely grey area,” notes Aviran Edery, svp and gm, marketplace at Verve Group. “How we define this need could make this Act hugely consequential or hugely impactful; in its current state, it’s difficult to gauge current impact,” he told Adweek. Another potential grey area, said Edery, is the ADPPA’s requirement of the implementation of reasonable policies, practices and procedures—and that such policies “consider” mitigating privacy risks related to minors. “[The term] 'consider' may be perceived as a bit of a softball,” he said. “Perhaps the onus needs to fall on brands and publishers, alike, to truly think about the ethics of such risks,” said Edery, who points to Disney, which decided not to run any commercials during programming catering to preschool children in its ad-supported streaming tier. A New Bill Aims to Limit Collection of Intimate Reproductive Data

Platforms

Recipe for a ‘Flood of Lawsuits’: Industry Calls for More Specificity on the Federal Privacy Bill

Loose definitions need tightening and the private right of action needs dampening, sources say

Establishing a standard to preempt state laws

Trishla Ostwal

About

Subscriptions

Events

Publications

Establishing a standard to preempt state laws

WORK SMARTER - LEARN, GROW AND BE INSPIRED.

Subscribe today!

Trishla Ostwal