Industry groups call on Congress to enact federal data privacy law

More than three dozen industry groups are asking Congressional leaders to pass federal data privacy legislation that will override a patchwork of disparate state privacy laws.

In a letter sent Tuesday, the groups pushed for a national standard that will be easier for businesses to adhere to. 

The missive sent to Republican and Democratic chairs of the House and Senate Commerce Committees says that a national privacy standard will “help start-ups and main street businesses compete on a broader scale, helping to lower prices and widen consumer access to goods and services.” 

Comprehensive federal data privacy legislation has long been sought by both parties in Congress, but proposed laws have never made it to the floor for a vote due to divisions, particularly on the question of preemption of state laws and private rights of action dictating whether individuals can sue over violations.

Data privacy legislation had been scheduled for a mark-up last June but proved so controversial that the hearing was cancelled. The legislation died when the Congressional session ended earlier this month. A similar effort also died in the prior Congressional session. 

If Congress preempts all existing state data privacy legislation, as the industry groups says it should, strong measures like a law in Illinois allowing individuals to sue when their biometric data privacy is violated — and California’s trailblazing law providing consumers with expansive privacy protections — would be replaced by a federal standard to be determined by a Republican-led Congress.

The letter notably omits any proposed regulation of data brokers and does not include the word data broker anywhere in its text. Data brokers play a major role in trafficking individuals’ personal data and previous Congressional privacy bills have included some language reining in the industry.

Privacy experts reacting to the letter said the proposed measures are similar to provisions contained in weaker state privacy laws like those enacted by Kentucky and Texas.

A national law should give individuals the right to know whether their data is being processed by companies; erase or correct their information; and opt out of advertising based on their web browsing habits and sales of their data, the letter says.

The proposed new federal privacy framework also should mandate that companies be transparent about their data practices and minimize the amount of data they collect to what is “reasonably necessary,” according to the letter.

Companies must obtain consumers’ consent before processing sensitive data and be barred from discriminating against people based on their data, said the letter, which was signed by the U.S. Chamber of Commerce and trade associations across sectors, including big tech and the automotive industry. 

The latter has been rocked by a series of data privacy scandals, with industry giant General Motors facing a lawsuit in Texas and a ban on data sales imposed by the Federal Trade Commission earlier this month.

The industry groups asked Congress not to apply federal data privacy legislation to small businesses, saying that only companies processing personal data belonging to more than 200,000 individuals or those processing personal data of more than 50,000 people while also generating more than half of their revenue from personal data sales should be regulated. 

Federal legislation should “not promote adversarial action that results in frivolous litigation,” the letter notes.

The letter was released the same day that influential privacy advocacy organizations published a report ranking nearly half of state privacy laws as failures which have led to weaker consumer protections than existed prior to their enactment.