The US is long overdue for a federal privacy law, but the American Data Privacy and Protection Act (ADPPA) might not be it.
At least not in its current form.
Although the ADPPA, which would establish a national standard for privacy protection, has bipartisan support, it still faces numerous roadblocks – and the question of preemption is one of the biggest.
Preemption invalidates any state law that conflicts with a federal law. The ADPPA includes a preemption provision, which means that if it were to pass, it would supersede all state privacy laws with minor exceptions.
Republicans are largely in favor of preemption, whereas most Democrats have said they’ll only support preemption as long as any eventual federal privacy law is as strong as state laws already on the books, particularly in California.
Last week, the ADPPA – which hasn’t advanced to a full vote in the House – hit a snag when Speaker Nancy Pelosi issued a statement to say she doesn’t support the bill as is.
Pelosi, whose district includes San Francisco, pointed to what others, including California Governor Gavin Newsom, have argued, which is the ADPPA “does not guarantee the same essential consumer protections as California’s existing privacy laws.”
Considering the midterms are two months away, it’s unlikely we’ll see a full vote on the House floor before the election.
And so we asked the experts: If the ADPPA doesn’t pass soon, what happens next?
- Caitlin Fennessy, VP and chief knowledge officer, International Association of Privacy Professionals (IAPP)
- Daniel Goldberg, partner, Frankfurt Kurnit Klein & Selz
- Cory Munchbach, president and COO, BlueConic
- Todd Ruback, managing director, privacy, FTI Consulting
Caitlin Fennessy, VP and chief knowledge officer, IAPP
We may be closer now to adoption of a comprehensive US federal privacy law than we have ever been. Speaker Pelosi paired her announcement that she will not bring the ADPPA to the House floor in its current form with the statement that her team will work with Rep. Frank Pallone (D-NJ), who cosponsored the bill, to address California’s concerns “in the days ahead.”
That time stamped call-to-action – and even the issuance of a press release – suggests that this bill is far from dead. We will certainly know soon, as September is widely viewed as the last window to move the bill before the midterm elections.
But regardless of election outcomes, Sen. Roger Wicker (R-Miss.), a long-time privacy champion and an ADPPA co-sponsor, will conclude his term as the ranking member of the Senate Commerce Committee.
And there are a lot of moving parts: Ted Cruz (R-TX) is expected to replace Wicker. There is a chance that Republicans could win one or both houses. California’s and Virginia’s privacy laws enter into force on January 1 and multiple other state legislatures are expected to tee up privacy bills of their own.
If the bill doesn’t pass now, it’s difficult to predict when we will see such an alignment of political will, industry interest and privacy advocacy again.
Daniel Goldberg, partner, Frankfurt Kurnit Klein & Selz
The legislature will need to go back to the drawing board on the issue of preemption. Many privacy advocates are concerned that the preemption language in the ADPPA undermines the privacy protections offered by comprehensive state privacy laws, including the California Consumer Privacy Act.
California – and businesses – have invested a significant amount of time and money in developing compliance frameworks for the CCPA, and the ADPPA arguably offers weaker protections than the CCPA. I expect that for the ADPPA to proceed, the legislature will need to carve out CCPA compliance obligations from the preemption language.
The problem is that if the legislature offers a carve out to California, it probably also needs to offer carve-outs to Virginia, Colorado, Connecticut and Utah. Ultimately, the ADPPA may need to be written as a floor, not a ceiling, on privacy rights in order to move forward.
Cory Munchbach, president and COO, BlueConic
If the ADPPA does not pass, it’ll be a rather startling failure given the bipartisan approach that got it here, as well as the particular context in which it failed to pass – namely, two straight weeks of major headlines related to consumer data privacy enforcement, from Sephora in California to Instagram in the EU.
In other words, failure to pass a privacy bill at such a moment of obvious support and need would be a wasted opportunity of enormous proportion. Not to mention that the FTC is waiting in the wings to fill the void with their recently announced proposed rulemaking. The two dissenting commissioners, Noah Phillips and Christine Wilson, flagged their strong preference for congressional action rather than FTC intervention, but if the ADPPA doesn’t pass, it clears the way for Lina Khan to proceed undeterred.
Meanwhile, I’m not convinced that who wins in November materially impacts the chances for this bill. The ADPPA is a topic for industry to get hot and bothered about rather than your average citizen, and Silicon Valley and tech have friends and foes on both sides of the aisle.
More than anything, the greatest risk to this bill is simply time. If they can’t get it done with this much momentum and zeitgeist on its side, then I can’t predict with any degree of confidence what would – or would not – make it likely to happen in the future.
Todd Ruback, managing director, privacy, FTI Consulting
I’m forever hopeful. Perhaps during the next congress the legislature will have more of an appetite to tackle much-needed privacy legislation. Not only does a comprehensive law have bipartisan legislative support, it cuts across a divided society and would be a rare example of a broadly supported law by the electorate.
And just as important as action on the domestic front, a comprehensive federal privacy law is an international trade issue. If the US wants to fully participate in the digital economy, it’s vital that we have legislation that provides at least as much privacy as other jurisdictions.
Without it, barriers will remain in place and the flow of both goods and services will continue to hit speed bumps, impacting our ability to stay competitive.
Responses have been lightly edited and condensed.
