What the Proposed Federal Privacy Law Could Mean for Businesses

SIA’s Data Privacy Advisory Board shares updates on the American Data Privacy and Protection Act, plus new efforts from the advisory board.

In this month’s update from the SIA Data Privacy Advisory Board, get the most current information on advisory board projects and events, then see updates on the latest privacy developments, legislative and regulatory activity and must-read articles on privacy topics. Questions and comments about any of the content can be directed to SIA Director of Industry Relations Ron Hawkins at rhawkins@securityindustry.org.

Data Privacy Advisory Board Update

The SIA The Data Privacy Advisory Board is preparing to release a Video Privacy Code of Practice. This document builds on the principles contained in the SIA Privacy Code of Conduct and provides more specific guidance for implementing sound privacy practices in video surveillance settings.

Legislative and Regulatory Developments

A broad data privacy proposal has been reported out of a U.S. House of Representatives panel, with strong bipartisan support, for consideration by the full chamber.

The American Data Privacy and Protection Act (H.R. 8152), according to the official bill summary, would establish “requirements for how companies, including nonprofits and common carriers, handle personal data, which includes information that identifies or is reasonably linkable to an individual.”

The bill cleared the House Energy and Commerce Committee, which is chaired by bill sponsor Rep. Frank Pallone (D-N.J.), by a vote of 53-2 on July 20.

If passed into law, the legislation would preempt state statutes, an issue that has long been a sticking point during congressional privacy negotiations. Members of the California delegation proposed an amendment that would have allowed the state’s Consumer Protection Act and Privacy Rights Act to be exempted, but it was defeated 48-8.

“There are areas, not too many in my opinion, where the California law is stronger and we have made an exception,” Pallone said. “But, basically, this amendment would reject all the efforts to come to a compromise by replacing carefully crafted preemption provisions, mindful of some of the states, with a provision that will not set a true federal standard.”

The debate over whether privacy legislation should include a private right of action has also been heated, and while this bill does include the measure, it limits such lawsuits to federal courts and includes certain arbitration provisions and class action waivers.

Even if the bill passes the House, its prospects in the Senate are uncertain, especially with only four months remaining before the current session of Congress adjourns.

In the Executive Branch, meanwhile, the Federal Trade Commission (FTC) issued a request for public comment “on the prevalence of commercial surveillance and data security practices that harm consumers.”

“Specifically, the Commission invites comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies (1) collect, aggregate, protect, use, analyze and retain consumer data, as well as (2) transfer, share, sell or otherwise monetize that data in ways that are unfair or deceptive,” the advanced notice of proposed rulemaking (ANPR) from the agency stated.

Analysts have suggested that FTC rulemaking on privacy in the absence of congressional action could lead to a legal challenge, but the agency asserted that it already has sufficient authority.

“The Commission is issuing this ANPR pursuant to Section 18 of the Federal Trade Commission Act (‘FTC Act’) and the Commission’s Rules of Practice because recent Commission actions, news reporting and public research suggest that harmful commercial surveillance and lax data security practices may be prevalent and increasingly unavoidable,” the notice stated. “These developments suggest that trade regulation rules reflecting these current realities may be needed to ensure Americans are protected from unfair or deceptive acts or practices. New rules could also foster a greater sense of predictability for companies and consumers and minimize the uncertainty that case-by-case enforcement may engender.”

The FTC will hold a virtual public forum on the proposal on Sept. 8 from 2:00 to 7:30 p.m. EDT.

Required Reading: Get the Latest Essential Privacy News

The New York Times: We’re About to Find Out What Happens When Privacy Is All but Gone, Aug. 23, 2022

Excerpt: Reconciling the idea of privacy with our digital world demands embracing a profound cognitive dissonance. To exist in 2022 is to be surveilled, tracked, tagged and monitored – most often for profit. Short of going off the grid, there’s no way around it.

The Conversation: A New U.S. Data Privacy Bill Aims to Give You More Control Over Information Collected About You – and Make Business Change How They Handle Data, Aug. 23, 2022

Excerpt: ADPPA fills the data privacy void, builds in federal preemption over some state data privacy laws, allows individuals to file suit over violations and substantially changes data privacy law enforcement. Like all big changes, ADPPA is getting mixed reviews from media, scholars and businesses. But many see the bill as a triumph for U.S. data privacy that provides a needed national standard for data practices.

Finger Lakes Times: Commentary: American Data Privacy and Protection Act Could Thwart Efforts to Save Abducted Children, Aug. 23, 2022

Excerpt: Just as the data privacy act lets anyone opt out of sharing data that advertisers use to track them, it enables child predators, rapists, human traffickers and violent criminals to opt out of private sector data services that law enforcement needs to investigate them – effectively forcing law enforcement to request warrants for accessing information that until now has been readily available to fight crime. The data privacy act would severely restrict law enforcement’s access to the tools it needs to rapidly conduct missing children’s investigations when every second counts.

S&P Global Market Intelligence: Supreme Court Decision Casts Shadow Over FTC Privacy Rulemaking Attempt, Aug. 22, 2022

Excerpt: The move comes as Congress remains stalled on a blanket federal privacy law, and it follows a recent U.S. Supreme Court ruling in which the majority indicated support for a legal doctrine that requires agencies to have clear statutory authority from Congress to impose regulations on issues of major national significance. Taken together, privacy experts said, the risk of legal challenges to the FTC’s commercial surveillance rulemaking is high unless Congress passes legislation granting it express regulatory authority over the matter.

TechTarget: Data Security as a Layer in Defense in Depth Against Ransomware, August 2022

Excerpt: Data security encompasses the principles and practice of ensuring legitimate access and preventing unauthorized access to data to preserve the cybersecurity triad.