Congress may be closer than ever to passing a comprehensive data privacy framework after key House and Senate committee leaders released a new proposal on Sunday.
The bipartisan proposal, titled the American Privacy Rights Act, or APRA, would limit the types of consumer data companies can collect, keep and use to what they need to operate their services. Users would also be able to opt out of targeted advertising and have the ability to view, correct, delete and download their data from online services. The proposal would also create a national registry of data brokers, forcing those companies to give users the ability to opt out of the sale of their data.
“This landmark legislation gives Americans the right to control where their information goes and who can sell it,” Cathy McMorris Rodgers, chair of the House Energy and Commerce Committee, said in a statement on Sunday. “It reins in Big Tech by prohibiting them from monitoring, predicting, and manipulating people’s behavior to make profits without their knowledge and consent. Americans overwhelmingly want these rights, and they expect us, their elected representatives, to take action.”
Congress has been trying for decades to create a comprehensive federal law that protects user data. However, lawmakers have remained divided over whether that legislation should prevent states from enacting stricter regulations, and whether to allow a “private right of action” that would allow people to sue companies in response to privacy violations .
In a interview with the Spokesperson assessment On Sunday, McMorris Rodgers asserted that the bill’s language is stronger than any active law, seemingly as an effort to address concerns of Democrats who have long fought efforts to prevent pre-existing protections at the state level. APRA allows states to adopt their own privacy laws regarding, among other things, civil rights and consumer protection.
Last session of Congress, leaders of the House Energy and Commerce Committees struck a deal with Roger Wicker, the top Republican on the Senate Commerce Committee, on a bill that would preempt state laws, except the California Consumer Privacy Act and the Illinois Biometric Information Privacy Act. That measure, entitled the US Data Privacy and Protection Act, also created a weaker private right of action than most Democrats were willing to support. Cantwell declined to support the measure, instead circulating her own bill. The ADPPA has not been re-enacted, but APRA was designed as a compromise.
“I think we’ve threaded a very important needle here,” Cantwell told the BBC Spokesperson assessment. “We are maintaining the standards that California, Illinois and Washington have.”
APRA incorporates language from California’s landmark privacy law, allowing people to sue companies if they are harmed by a data breach. It also gives the Federal Trade Commission, attorneys general and private citizens the power to sue companies when they violate the law.
However, it remains unclear whether APRA will receive the necessary support for approval. On Sunday, committee members said discussions were underway about other lawmakers signing the legislation. The current proposal is a “discussion draft”; While there is no official date for a bill to be introduced, Cantwell and McMorris Rodgers will likely review the text to colleagues for feedback in the coming weeks and plan to send it to committees this month.
This is a development story. Check back later for updates.