House GOP Rushing to Advance Federal Privacy Law Before Midterms

According to Politico, the main sticking point concerns a private right of action allowing consumers to sue companies that violate their privacy rights. According to a Politico source who has seen the GOP’s draft, the bill does not include a private right of action, leaving enforcement up to state attorneys general or the Federal Trade Commission. Democrats want to arm consumers with the ability to sue companies that violate their rights, even if their state AG does not take action, and allow states to enact tougher privacy standards than any federal base line.

The draft federal law would preempt roughly 20 state laws currently on the books. According to Politico’s source, the Republican draft is closely modeled on Kentucky’s privacy statute, which does not include a private right to sue.

The committee is working against the clock. With the legislative calendar ticking down to summer, when nearly all such activity will stop ahead of the fall’s high-stakes midterm elections, and several big-ticket items such as end the current shutdown of the Department of Homeland Security likely to occupy much of the remaining time, the committee does not have much leeway to act if it hopes to pass something before a new Congress is sworn in in January.

According to Rep. Jay Olbernote (R-CA), a member of the Energy & Commerce Privacy Working Group, the committee has run into delays in finalizing the language of the draft bill.

Related: White House, GOP Again Trying to Enact Federal Preemption of State AI Laws

“I think everyone’s on the same page in that we want to introduce it just as soon as we possibly can, and it’s been a little frustrating for everybody that it’s taken this long, but you want to make sure you get it right,” he told Politico.

The draft currently is expected to be released within the next two weeks, with a hearing on the bill tentatively slated for May.

The GOP bill is likely to include new language on children’s online safety, according to the person who has seen the current draft, which could also trigger a clash with Democrats. Committee Democrats fought the Republican version of the Children and Teens’ Online Privacy Protection Act in March, over language preempting state laws, and would likely oppose including federal preemption in any general privacy law.

“Republicans claimed they have been working on privacy legislation for months, but it sounds like they just copied and pasted someone else’s homework,” the committee’s Democratic spokesperson, CJ Young, said. “We need a strong federal privacy standard.”

Two people who have seen the draft told Politico it would require companies to obtain consent before collecting sensitive data such as health information, location data, biometric information and most data belonging to children under 13.

That relatively low age limit could also provoke debate. Jurisdictions that have enacted or are considering age limits for social media access have generally set the age threshold at 16, which is emerging as something like a global standard as the age of online consent.