For the first time in years, members of U.S. Congress have found common ground on comprehensive federal privacy legislation and a bipartisan framework may be in reach. Politico reported members of the U.S. Senate and House are circulating a draft bill that includes bipartisan compromise on the two biggest stumbling blocks between parties, federal preemption and the private right of action. The draft from Senate Committee on Commerce, Science, and Transportation Ranking Member Roger Wicker, R-Miss., and House Committee on Energy and Commerce leaders Frank Pallone, D-N.J., and Cathy McMorris Rodgers, R-Wash., speaks to previously reported momentum between chambers and parties, but the proposal also hasn't yet garnered the support of Senate Commerce Committee Chair Maria Cantwell, D-Wash., arguably the most important legislator working on federal privacy legislation.

Points of consensus

Details around what exactly was agreed to with preemption and the PRA aren't clear at this point. Sources familiar with negotiations on the bipartisan draft told Politico that preemption would have some exceptions but cover most state laws while the PRA would be limited in some fashion. Having both provisions in one bill would be no small feat as the IAPP "Federal Privacy Legislation Tracker" shows every privacy bill currently under consideration with the 117th Congress carries one or the other but not both. 

"We've made significant strides," R Street Institute Policy Director Tatyana Bolton said during an IAPP LinkedIn Live event in May that focused on the current state of federal privacy talks. "Nobody thought we'd end up with preemption or no preemption, PRA or no PRA, but I think that was really where we were at the beginning of this year … We've made a bit of movement and it gives me optimism."

Discussions around preemption are the most tangled between the two disputes given how it will affect state legislatures' abilities to address issues in their own way and specifically to the circumstances they fall under or deal with. There's been some agreement over limits to preemption for areas of state control or federal mandate as well as legislating on emerging technology issues.

"You've seen a willingness to negotiate because really broad preemption does hit traditional areas of state control that I don't think a lot people actually wanted overturned at the state level, so there were going to have to be real considerations," Public Knowledge Senior Policy Counsel Sara Collins said during the recent IAPP LinkedIn Live. "I do think about what emerging technology or futureproofing might go into preemption as well. If (Congress) doesn't say anything about biometrics then maybe (Congress) will let the states deal with that. Genetic privacy could be another."

Arguments for and against a PRA are a little more simplified with conversations mostly around thresholds, which companies can be sued and ensuring lawsuits are for actual damages. As Casentino Strategies founder and Principal Paula Bruening wrote for the IAPP in January, a PRA "can be designed with guardrails that limit the potential for frivolous or harassing lawsuits but preserve the ability of individuals to bring cases in appropriate circumstances."

Bruening also provided a five-pronged blueprint for a how Congress could tailor a workable PRA into a federal privacy proposal. Her considerations included case reviews, a right to cure where appropriate, limits on payouts for damages and limits on the types of violations consumers can file suits on.

Racing against time

Bipartisanship makes up a majority of the fuel behind the new draft bill, but time constraints are certainly a consideration. Time is running short on the Congressional calendar and brings a few panic points to the surface. 

IAPP Managing Director, Washington, D.C., Cobun Zweifel-Keegan, CIPP/US, CIPM, recently pulled back the curtain on potential changes to Republican leadership in the Senate Committee on Commerce, Science, and Transportation, with Sen. Wicker likely switching committees after midterm elections in November. Wicker has been persistent with his desires to reach the finish line on privacy, whether it be through his own privacy proposals or using his time as Commerce Committee chair and ranking member to call hearings to explore the paths to legislating on privacy issues.

Politico also outlined a motivation for Sen. Cantwell to either get on board with the latest bipartisan proposal or convince authors of that bill to meet her halfway. A Cantwell spokesperson said she intends to hold a committee markup this month on a comprehensive privacy proposal, but there's no indication exactly what bill will be acted upon. Cantwell's move to hit the gas pedal comes with reports that she and Senate Majority Leader Chuck Schumer, D-N.Y., had a conversation regarding quick committee finalization of a bill, presumably to get it to the floor before the tides potentially change in November.

The hang-up for Cantwell appears to be the PRA, as her proposal seeks to empower consumers more than what Wicker, Pallone and McMorris Rodgers have compromised on.

Photo by Darren Halstead on Unsplash