Lawmakers unveil new bipartisan digital privacy bill after years of impasse

A pair of bipartisan lawmakers released a new comprehensive privacy proposal on Sunday, the first sign in years that Congress could have a shot at breaking the long-standing impasse in passing such protections.

Senate Commerce Committee Chair Maria Cantwell (D-WA) and House Energy and Commerce Committee Chair Cathy McMorris Rodgers (R-WA) unveiled the American Privacy Rights Act, the most significant comprehensive data privacy proposal introduced in years. The draft bill would grant consumers new rights regarding how their information is used and moved around by large companies and data brokers while giving them the ability to sue when those rights are violated.

The bill will still need to be introduced into both chambers and advanced by each committee to have a shot at being passed into law. While aides for the committees told a group of reporters on a background call Sunday that there was not yet a target date for introduction, Rodgers said in the statement she expects the bill to move “through regular order” on her committee this month.

The legislation would require large companies to minimize the amount of data they collect on users and allow them to correct, delete, or export their data. It would give consumers the right to opt out of targeted advertising and the transfer of their information and let them opt out of the use of an algorithm to make important life decisions for them, like those related to housing, employment, education, and insurance. The bill would also mandate security protections to safeguard consumers’ private information.

The Federal Trade Commission and individual states could enforce the law, which also includes a private right of action for individual consumers to bring lawsuits where their privacy rights are violated. It prohibits forced arbitration in the case of substantial privacy harm or harm to minors. It would largely preempt state privacy laws while preserving aspects like relief available under Illinois’ biometric privacy law and California’s privacy law.

It’s the first major bipartisan proposal for a comprehensive privacy bill since the American Data Privacy Protection Act was introduced two years ago. But that bill lacked Cantwell’s support, the missing piece of the so-called four corners of Senate Commerce and House E&C leadership that backed the proposal. Her failure to support that bill ultimately stalled what, at the time, was the most significant comprehensive bipartisan digital privacy agreement.

Cantwell objected to the hurdles the earlier bill put in place for individuals to sue for alleged violations of their privacy rights, an E&C aide noted on the call with reporters, like requiring them to notify their state attorney general and the Federal Trade Commission before filing suit. The new discussion draft doesn’t have the same requirement and includes a strong private right of action, meaning individual consumers can sue companies covered by the legislation if they believe their rights were violated.

But it also gives companies the chance to correct the allegedly violating behavior. People who want to sue for injunctive relief or damages need to first give notice of the alleged violation, and the company would have 30 days to cure the issue. But the bill does not require notice before filing a claim for “substantial privacy harm,” which could include alleged financial loss of at least $10,000, or certain physical or mental harm.

While the two Washington state lawmakers did not name their ranking members, Sen. Ted Cruz (R-TX) and Rep. Frank Pallone (D-NJ), as co-sponsors of the proposal, an E&C aide told reporters that Rodgers has had “positive conversations” with both on the subject of privacy. A Commerce aide added that the two committee chairs happened to align their priorities in a similar moment and had the momentum to “hammer out this deal.”

Pallone released a statement on the proposal Sunday, calling it “a very strong discussion draft,” but said there are still “some key areas where I think we can strengthen the bill, especially children’s privacy.” Pallone added that he’s “optimistic that we’ll be able to build on that record as Chair Rodgers and I work together to get comprehensive privacy legislation across the finish line.” A spokesperson for Cruz did not immediately respond to a request for comment Monday on the proposal.

The draft proposal comes as the House has moved forward with legislation to ban or force a sale of TikTok over security concerns and a separate bill to ban data brokers from selling US consumer data to foreign adversaries. A Commerce aide told reporters the draft bill is completely separate from the one about TikTok and there are no current plans to move them in tandem.

“Americans overwhelmingly want these rights,” Rodgers said in a statement, “and they are looking to us, their elected representatives, to act.”